1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, split Aug 14 2005
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // The common USB driver used for both the bootloader and the application.
9 //-----------------------------------------------------------------------------
11 #include "proxmark3.h"
13 #define min(a, b) (((a) > (b)) ? (b) : (a))
15 #define USB_REPORT_PACKET_SIZE 64
17 typedef struct PACKED
{
18 uint8_t bmRequestType
;
25 #define USB_REQUEST_GET_STATUS 0
26 #define USB_REQUEST_CLEAR_FEATURE 1
27 #define USB_REQUEST_SET_FEATURE 3
28 #define USB_REQUEST_SET_ADDRESS 5
29 #define USB_REQUEST_GET_DESCRIPTOR 6
30 #define USB_REQUEST_SET_DESCRIPTOR 7
31 #define USB_REQUEST_GET_CONFIGURATION 8
32 #define USB_REQUEST_SET_CONFIGURATION 9
33 #define USB_REQUEST_GET_INTERFACE 10
34 #define USB_REQUEST_SET_INTERFACE 11
35 #define USB_REQUEST_SYNC_FRAME 12
37 #define USB_DESCRIPTOR_TYPE_DEVICE 1
38 #define USB_DESCRIPTOR_TYPE_CONFIGURATION 2
39 #define USB_DESCRIPTOR_TYPE_STRING 3
40 #define USB_DESCRIPTOR_TYPE_INTERFACE 4
41 #define USB_DESCRIPTOR_TYPE_ENDPOINT 5
42 #define USB_DESCRIPTOR_TYPE_DEVICE_QUALIFIER 6
43 #define USB_DESCRIPTOR_TYPE_OTHER_SPEED_CONF 7
44 #define USB_DESCRIPTOR_TYPE_INTERFACE_POWER 8
45 #define USB_DESCRIPTOR_TYPE_HID 0x21
46 #define USB_DESCRIPTOR_TYPE_HID_REPORT 0x22
48 #define USB_DEVICE_CLASS_HID 0x03
50 static const uint8_t HidReportDescriptor
[] = {
51 0x06,0xA0,0xFF, // Usage Page (vendor defined) FFA0
52 0x09,0x01, // Usage (vendor defined)
53 0xA1,0x01, // Collection (Application)
54 0x09,0x02, // Usage (vendor defined)
55 0xA1,0x00, // Collection (Physical)
56 0x06,0xA1,0xFF, // Usage Page (vendor defined)
59 0x09,0x03, // usage - vendor defined
60 0x09,0x04, // usage - vendor defined
61 0x15,0x80, // Logical Minimum (-128)
62 0x25,0x7F, // Logical Maximum (127)
63 0x35,0x00, // Physical Minimum (0)
64 0x45,0xFF, // Physical Maximum (255)
65 0x75,0x08, // Report Size (8) (bits)
66 0x95,0x40, // Report Count (64) (fields)
67 0x81,0x02, // Input (Data,Variable,Absolute)
70 0x09,0x05, // usage - vendor defined
71 0x09,0x06, // usage - vendor defined
72 0x15,0x80, // Logical Minimum (-128)
73 0x25,0x7F, // Logical Maximum (127)
74 0x35,0x00, // Physical Minimum (0)
75 0x45,0xFF, // Physical Maximum (255)
76 0x75,0x08, // Report Size (8) (bits)
77 0x95,0x40, // Report Count (64) (fields)
78 0x91,0x02, // Output (Data,Variable,Absolute)
80 0xC0, // End Collection
82 0xC0, // End Collection
85 static const uint8_t DeviceDescriptor
[] = {
86 0x12, // Descriptor length (18 bytes)
87 0x01, // Descriptor type (Device)
88 0x10,0x01, // Complies with USB Spec. Release (0110h = release 1.10)
89 0x00, // Class code (0)
90 0x00, // Subclass code (0)
91 0x00, // Protocol (No specific protocol)
92 0x08, // Maximum packet size for Endpoint 0 (8 bytes)
93 0xc4,0x9a, // Vendor ID (random numbers)
94 0x8f,0x4b, // Product ID (random numbers)
95 0x01,0x00, // Device release number (0001)
96 0x01, // Manufacturer string descriptor index
97 0x02, // Product string descriptor index
98 0x00, // Serial Number string descriptor index (None)
99 0x01, // Number of possible configurations (1)
102 static const uint8_t ConfigurationDescriptor
[] = {
103 0x09, // Descriptor length (9 bytes)
104 0x02, // Descriptor type (Configuration)
105 0x29,0x00, // Total data length (41 bytes)
106 0x01, // Interface supported (1)
107 0x01, // Configuration value (1)
108 0x00, // Index of string descriptor (None)
109 0x80, // Configuration (Bus powered)
110 250, // Maximum power consumption (500mA)
113 0x09, // Descriptor length (9 bytes)
114 0x04, // Descriptor type (Interface)
115 0x00, // Number of interface (0)
116 0x00, // Alternate setting (0)
117 0x02, // Number of interface endpoint (2)
118 0x03, // Class code (HID)
119 0x00, // Subclass code ()
120 0x00, // Protocol code ()
121 0x00, // Index of string()
124 0x09, // Descriptor length (9 bytes)
125 0x21, // Descriptor type (HID)
126 0x00,0x01, // HID class release number (1.00)
127 0x00, // Localized country code (None)
128 0x01, // # of HID class dscrptr to follow (1)
129 0x22, // Report descriptor type (HID)
130 // Total length of report descriptor
131 sizeof(HidReportDescriptor
),0x00,
134 0x07, // Descriptor length (7 bytes)
135 0x05, // Descriptor type (Endpoint)
136 0x01, // Encoded address (Respond to OUT)
137 0x03, // Endpoint attribute (Interrupt transfer)
138 0x08,0x00, // Maximum packet size (8 bytes)
139 0x01, // Polling interval (1 ms)
142 0x07, // Descriptor length (7 bytes)
143 0x05, // Descriptor type (Endpoint)
144 0x82, // Encoded address (Respond to IN)
145 0x03, // Endpoint attribute (Interrupt transfer)
146 0x08,0x00, // Maximum packet size (8 bytes)
147 0x01, // Polling interval (1 ms)
150 static const uint8_t StringDescriptor0
[] = {
152 0x03, // Type is string
157 static const uint8_t StringDescriptor1
[] = {
159 0x03, // Type is string
173 static const uint8_t StringDescriptor2
[] = {
175 0x03, // Type is string
204 static const uint8_t * const StringDescriptors
[] = {
211 static uint8_t UsbBuffer
[64];
212 static int UsbSoFarCount
;
214 static uint8_t CurrentConfiguration
;
216 static void UsbSendEp0(const uint8_t *data
, int len
)
221 thisTime
= min(len
, 8);
224 for(i
= 0; i
< thisTime
; i
++) {
225 AT91C_BASE_UDP
->UDP_FDR
[0] = *data
;
229 if(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_TXCOMP
) {
230 AT91C_BASE_UDP
->UDP_CSR
[0] &= ~AT91C_UDP_TXCOMP
;
231 while(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_TXCOMP
)
235 AT91C_BASE_UDP
->UDP_CSR
[0] |= AT91C_UDP_TXPKTRDY
;
238 if(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_RX_DATA_BK0
) {
239 // This means that the host is trying to write to us, so
240 // abandon our write to them.
241 AT91C_BASE_UDP
->UDP_CSR
[0] &= ~AT91C_UDP_RX_DATA_BK0
;
244 } while(!(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_TXCOMP
));
247 if(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_TXCOMP
) {
248 AT91C_BASE_UDP
->UDP_CSR
[0] &= ~AT91C_UDP_TXCOMP
;
249 while(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_TXCOMP
)
254 static void UsbSendZeroLength(void)
256 AT91C_BASE_UDP
->UDP_CSR
[0] |= AT91C_UDP_TXPKTRDY
;
258 while(!(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_TXCOMP
))
261 AT91C_BASE_UDP
->UDP_CSR
[0] &= ~AT91C_UDP_TXCOMP
;
263 while(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_TXCOMP
)
267 static void UsbSendStall(void)
269 AT91C_BASE_UDP
->UDP_CSR
[0] |= AT91C_UDP_FORCESTALL
;
271 while(!(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_STALLSENT
))
274 AT91C_BASE_UDP
->UDP_CSR
[0] &= ~AT91C_UDP_STALLSENT
;
276 while(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_STALLSENT
)
280 static void HandleRxdSetupData(void)
285 for(i
= 0; i
< sizeof(usd
); i
++) {
286 ((uint8_t *)&usd
)[i
] = AT91C_BASE_UDP
->UDP_FDR
[0];
289 if(usd
.bmRequestType
& 0x80) {
290 AT91C_BASE_UDP
->UDP_CSR
[0] |= AT91C_UDP_DIR
;
291 while(!(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_DIR
))
295 AT91C_BASE_UDP
->UDP_CSR
[0] &= ~AT91C_UDP_RXSETUP
;
296 while(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_RXSETUP
)
299 switch(usd
.bRequest
) {
300 case USB_REQUEST_GET_DESCRIPTOR
:
301 if((usd
.wValue
>> 8) == USB_DESCRIPTOR_TYPE_DEVICE
) {
302 UsbSendEp0((uint8_t *)&DeviceDescriptor
,
303 min(sizeof(DeviceDescriptor
), usd
.wLength
));
304 } else if((usd
.wValue
>> 8) == USB_DESCRIPTOR_TYPE_CONFIGURATION
) {
305 UsbSendEp0((uint8_t *)&ConfigurationDescriptor
,
306 min(sizeof(ConfigurationDescriptor
), usd
.wLength
));
307 } else if((usd
.wValue
>> 8) == USB_DESCRIPTOR_TYPE_STRING
) {
308 const uint8_t *s
= StringDescriptors
[usd
.wValue
& 0xff];
309 UsbSendEp0(s
, min(s
[0], usd
.wLength
));
310 } else if((usd
.wValue
>> 8) == USB_DESCRIPTOR_TYPE_HID_REPORT
) {
311 UsbSendEp0((uint8_t *)&HidReportDescriptor
,
312 min(sizeof(HidReportDescriptor
), usd
.wLength
));
314 *((uint32_t *)0x00200000) = usd
.wValue
;
318 case USB_REQUEST_SET_ADDRESS
:
320 AT91C_BASE_UDP
->UDP_FADDR
= AT91C_UDP_FEN
| usd
.wValue
;
321 if(usd
.wValue
!= 0) {
322 AT91C_BASE_UDP
->UDP_GLBSTATE
= AT91C_UDP_FADDEN
;
324 AT91C_BASE_UDP
->UDP_GLBSTATE
= 0;
328 case USB_REQUEST_GET_CONFIGURATION
:
329 UsbSendEp0(&CurrentConfiguration
, sizeof(CurrentConfiguration
));
332 case USB_REQUEST_GET_STATUS
: {
333 if(usd
.bmRequestType
& 0x80) {
335 UsbSendEp0((uint8_t *)&w
, sizeof(w
));
339 case USB_REQUEST_SET_CONFIGURATION
:
340 CurrentConfiguration
= usd
.wValue
;
341 if(CurrentConfiguration
) {
342 AT91C_BASE_UDP
->UDP_GLBSTATE
= AT91C_UDP_CONFG
;
343 AT91C_BASE_UDP
->UDP_CSR
[1] = AT91C_UDP_EPEDS
|
344 AT91C_UDP_EPTYPE_INT_OUT
;
345 AT91C_BASE_UDP
->UDP_CSR
[2] = AT91C_UDP_EPEDS
|
346 AT91C_UDP_EPTYPE_INT_IN
;
348 AT91C_BASE_UDP
->UDP_GLBSTATE
= AT91C_UDP_FADDEN
;
349 AT91C_BASE_UDP
->UDP_CSR
[1] = 0;
350 AT91C_BASE_UDP
->UDP_CSR
[2] = 0;
355 case USB_REQUEST_GET_INTERFACE
: {
357 UsbSendEp0(&b
, sizeof(b
));
361 case USB_REQUEST_SET_INTERFACE
:
365 case USB_REQUEST_CLEAR_FEATURE
:
366 case USB_REQUEST_SET_FEATURE
:
369 case USB_REQUEST_SET_DESCRIPTOR
:
370 case USB_REQUEST_SYNC_FRAME
:
376 void UsbSendPacket(uint8_t *packet
, int len
)
381 thisTime
= min(len
, 8);
383 for(i
= 0; i
< thisTime
; i
++) {
384 AT91C_BASE_UDP
->UDP_FDR
[2] = packet
[i
];
386 AT91C_BASE_UDP
->UDP_CSR
[2] |= AT91C_UDP_TXPKTRDY
;
388 while(!(AT91C_BASE_UDP
->UDP_CSR
[2] & AT91C_UDP_TXCOMP
))
390 AT91C_BASE_UDP
->UDP_CSR
[2] &= ~AT91C_UDP_TXCOMP
;
392 while(AT91C_BASE_UDP
->UDP_CSR
[2] & AT91C_UDP_TXCOMP
)
400 static void HandleRxdData(void)
404 if(AT91C_BASE_UDP
->UDP_CSR
[1] & AT91C_UDP_RX_DATA_BK0
) {
405 len
= UDP_CSR_BYTES_RECEIVED(AT91C_BASE_UDP
->UDP_CSR
[1]);
407 for(i
= 0; i
< len
; i
++) {
408 UsbBuffer
[UsbSoFarCount
] = AT91C_BASE_UDP
->UDP_FDR
[1];
412 AT91C_BASE_UDP
->UDP_CSR
[1] &= ~AT91C_UDP_RX_DATA_BK0
;
413 while(AT91C_BASE_UDP
->UDP_CSR
[1] & AT91C_UDP_RX_DATA_BK0
)
416 if(UsbSoFarCount
>= 64) {
417 UsbPacketReceived(UsbBuffer
, UsbSoFarCount
);
422 if(AT91C_BASE_UDP
->UDP_CSR
[1] & AT91C_UDP_RX_DATA_BK1
) {
423 len
= UDP_CSR_BYTES_RECEIVED(AT91C_BASE_UDP
->UDP_CSR
[1]);
425 for(i
= 0; i
< len
; i
++) {
426 UsbBuffer
[UsbSoFarCount
] = AT91C_BASE_UDP
->UDP_FDR
[1];
430 AT91C_BASE_UDP
->UDP_CSR
[1] &= ~AT91C_UDP_RX_DATA_BK1
;
431 while(AT91C_BASE_UDP
->UDP_CSR
[1] & AT91C_UDP_RX_DATA_BK1
)
434 if(UsbSoFarCount
>= 64) {
435 UsbPacketReceived(UsbBuffer
, UsbSoFarCount
);
447 USB_D_PLUS_PULLUP_OFF();
449 for(i
= 0; i
< 1000000; i
++)
452 USB_D_PLUS_PULLUP_ON();
454 if(AT91C_BASE_UDP
->UDP_ISR
& AT91C_UDP_ENDBUSRES
) {
455 AT91C_BASE_UDP
->UDP_ICR
= AT91C_UDP_ENDBUSRES
;
461 if (AT91C_BASE_UDP
->UDP_GLBSTATE
& AT91C_UDP_CONFG
)
467 int UsbPoll(int blinkLeds
)
471 if(AT91C_BASE_UDP
->UDP_ISR
& AT91C_UDP_ENDBUSRES
) {
472 AT91C_BASE_UDP
->UDP_ICR
= AT91C_UDP_ENDBUSRES
;
474 // following a reset we should be ready to receive a setup packet
475 AT91C_BASE_UDP
->UDP_RSTEP
= 0xf;
476 AT91C_BASE_UDP
->UDP_RSTEP
= 0;
478 AT91C_BASE_UDP
->UDP_FADDR
= AT91C_UDP_FEN
;
480 AT91C_BASE_UDP
->UDP_CSR
[0] = AT91C_UDP_EPTYPE_CTRL
| AT91C_UDP_EPEDS
;
482 CurrentConfiguration
= 0;
487 if(AT91C_BASE_UDP
->UDP_ISR
& UDP_INTERRUPT_ENDPOINT(0)) {
488 if(AT91C_BASE_UDP
->UDP_CSR
[0] & AT91C_UDP_RXSETUP
) {
489 HandleRxdSetupData();
494 if(AT91C_BASE_UDP
->UDP_ISR
& UDP_INTERRUPT_ENDPOINT(1)) {