bootrom/bootrom.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) Jonathan Westhues, Mar 2006
   3 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
   4 //
   5 // This program is free software: you can redistribute it and/or modify
   6 // it under the terms of the GNU General Public License as published by
   7 // the Free Software Foundation, either version 3 of the License, or
   8 // (at your option) any later version.
   9 //
  10 // This program is distributed in the hope that it will be useful,
  11 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 // GNU General Public License for more details.
  14 //
  15 // See LICENSE.txt for the text of the license.
  16 //-----------------------------------------------------------------------------
  17 // Main code for the bootloader
  18 //-----------------------------------------------------------------------------
  19
  20 #include "clocks.h"
  21 #include "usb_cdc.h"
  22
  23 #ifdef WITH_FLASH
  24 #include "flashmem.h"
  25 #endif
  26
  27 #include "proxmark3_arm.h"
  28 #define DEBUG 0
  29
  30 common_area_t g_common_area __attribute__((section(".commonarea")));
  31 uint32_t start_addr, end_addr;
  32 bool bootrom_unlocked;
  33 extern uint32_t _bootrom_start[], _bootrom_end[], _flash_start[], _flash_end[], _osimage_entry[], __bss_start__[], __bss_end__[];
  34
  35 static int reply_old(uint64_t cmd, uint64_t arg0, uint64_t arg1, uint64_t arg2, void *data, size_t len) {
  36     PacketResponseOLD txcmd;
  37
  38     for (size_t i = 0; i < sizeof(PacketResponseOLD); i++)
  39         ((uint8_t *)&txcmd)[i] = 0x00;
  40
  41     // Compose the outgoing command frame
  42     txcmd.cmd = cmd;
  43     txcmd.arg[0] = arg0;
  44     txcmd.arg[1] = arg1;
  45     txcmd.arg[2] = arg2;
  46
  47     // Add the (optional) content to the frame, with a maximum size of PM3_CMD_DATA_SIZE
  48     if (data && len) {
  49         len = MIN(len, PM3_CMD_DATA_SIZE);
  50         for (size_t i = 0; i < len; i++) {
  51             txcmd.d.asBytes[i] = ((uint8_t *)data)[i];
  52         }
  53     }
  54
  55     // Send frame and make sure all bytes are transmitted
  56     return usb_write((uint8_t *)&txcmd, sizeof(PacketResponseOLD));
  57 }
  58
  59 #if DEBUG
  60 static void DbpString(char *str) {
  61     uint8_t len = 0;
  62     while (str[len] != 0x00) {
  63         len++;
  64     }
  65     reply_old(CMD_DEBUG_PRINT_STRING, len, 0, 0, (uint8_t *)str, len);
  66 }
  67 #endif
  68
  69 static void ConfigClocks(void) {
  70     // we are using a 16 MHz crystal as the basis for everything
  71     // slow clock runs at 32kHz typical regardless of crystal
  72
  73     // enable system clock and USB clock
  74     AT91C_BASE_PMC->PMC_SCER |= AT91C_PMC_PCK | AT91C_PMC_UDP;
  75
  76     // enable the clock to the following peripherals
  77     AT91C_BASE_PMC->PMC_PCER =
  78         (1 << AT91C_ID_PIOA)   |
  79         (1 << AT91C_ID_ADC)    |
  80         (1 << AT91C_ID_SPI)    |
  81         (1 << AT91C_ID_SSC)    |
  82         (1 << AT91C_ID_PWMC)   |
  83         (1 << AT91C_ID_UDP);
  84
  85     mck_from_slck_to_pll();
  86 }
  87
  88 static void Fatal(void) {
  89     for (;;) {};
  90 }
  91
  92 static uint32_t flash_size_from_cidr(uint32_t cidr) {
  93     uint8_t nvpsiz = (cidr & 0xF00) >> 8;
  94     switch (nvpsiz) {
  95         case 0:
  96             return 0;
  97         case 1:
  98             return 8 * 1024;
  99         case 2:
 100             return 16 * 1024;
 101         case 3:
 102             return 32 * 1024;
 103         case 5:
 104             return 64 * 1024;
 105         case 7:
 106             return 128 * 1024;
 107         case 9:
 108             return 256 * 1024;
 109         case 10:
 110             return 512 * 1024;
 111         case 12:
 112             return 1024 * 1024;
 113         case 14:
 114         default: // for 'reserved' values, guess 2MB
 115             return 2048 * 1024;
 116     }
 117 }
 118
 119 static uint32_t get_flash_size(void) {
 120     return flash_size_from_cidr(*AT91C_DBGU_CIDR);
 121 }
 122
 123 static void UsbPacketReceived(uint8_t *packet) {
 124     bool ack = true;
 125     PacketCommandOLD *c = (PacketCommandOLD *)packet;
 126
 127     //if ( len != sizeof(PacketCommandOLD`)) Fatal();
 128
 129     uint32_t arg0 = (uint32_t)c->arg[0];
 130
 131     switch (c->cmd) {
 132         case CMD_DEVICE_INFO: {
 133             ack = false;
 134             arg0 = 0;
 135             arg0 = DEVICE_INFO_FLAG_BOOTROM_PRESENT |
 136                    DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM |
 137                    DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH |
 138                    DEVICE_INFO_FLAG_UNDERSTANDS_CHIP_INFO |
 139                    DEVICE_INFO_FLAG_UNDERSTANDS_VERSION |
 140                    DEVICE_INFO_FLAG_UNDERSTANDS_READ_MEM;
 141
 142             if (g_common_area.flags.osimage_present) {
 143                 arg0 |= DEVICE_INFO_FLAG_OSIMAGE_PRESENT;
 144             }
 145
 146             reply_old(CMD_DEVICE_INFO, arg0, 1, 2, 0, 0);
 147         }
 148         break;
 149
 150         case CMD_CHIP_INFO: {
 151             ack = false;
 152             arg0 = *(AT91C_DBGU_CIDR);
 153             reply_old(CMD_CHIP_INFO, arg0, 0, 0, 0, 0);
 154         }
 155         break;
 156
 157         case CMD_BL_VERSION: {
 158             ack = false;
 159             arg0 = BL_VERSION_1_0_0;
 160             reply_old(CMD_BL_VERSION, arg0, 0, 0, 0, 0);
 161         }
 162         break;
 163
 164         case CMD_READ_MEM_DOWNLOAD: {
 165             ack = false;
 166             LED_B_ON();
 167
 168             size_t offset = (size_t) c->arg[0];
 169             size_t count = (size_t) c->arg[1];
 170             uint32_t flags = (uint32_t) c->arg[2];
 171
 172             bool isok = true;
 173             uint8_t *base = NULL;
 174
 175             bool raw_address_mode = ((flags & READ_MEM_DOWNLOAD_FLAG_RAW) == READ_MEM_DOWNLOAD_FLAG_RAW);
 176             if (!raw_address_mode) {
 177
 178                 base = (uint8_t *) _flash_start;
 179
 180                 size_t flash_size = get_flash_size();
 181
 182                 // Boundary check the offset.
 183                 if (offset > flash_size)
 184                     isok = false;
 185
 186                 // Clip the length if it goes past the end of the flash memory.
 187                 count = MIN(count, flash_size - offset);
 188
 189             } else {
 190                 // Allow reading from any memory address and length in special 'raw' mode.
 191                 base = NULL;
 192                 // Boundary check against end of addressable space.
 193                 if (offset > 0)
 194                     count = MIN(count, -offset);
 195             }
 196
 197             if (isok) {
 198                 for (size_t pos = 0; pos < count; pos += PM3_CMD_DATA_SIZE) {
 199                     size_t len = MIN((count - pos), PM3_CMD_DATA_SIZE);
 200                     isok = 0 == reply_old(CMD_READ_MEM_DOWNLOADED, pos, len, 0, &base[offset + pos], len);
 201                     if (!isok)
 202                         break;
 203                 }
 204             }
 205
 206             if (isok)
 207                 reply_old(CMD_ACK, 1, 0, 0, 0, 0);
 208             else
 209                 reply_old(CMD_NACK, 0, 0, 0, 0, 0);
 210
 211             LED_B_OFF();
 212             break;
 213         }
 214
 215         case CMD_FINISH_WRITE: {
 216 #if defined ICOPYX
 217             if (c->arg[1] == 0xff && c->arg[2] == 0x1fd) {
 218 #endif
 219                 for (int j = 0; j < 2; j++) {
 220                     uint32_t flash_address = arg0 + (0x100 * j);
 221                     AT91PS_EFC efc_bank = AT91C_BASE_EFC0;
 222                     int offset = 0;
 223                     uint32_t page_n = (flash_address - (uint32_t)_flash_start) / AT91C_IFLASH_PAGE_SIZE;
 224                     if (page_n >= AT91C_IFLASH_NB_OF_PAGES / 2) {
 225                         page_n -= AT91C_IFLASH_NB_OF_PAGES / 2;
 226                         efc_bank = AT91C_BASE_EFC1;
 227                         // We need to offset the writes or it will not fill the correct bank write buffer.
 228                         offset = (AT91C_IFLASH_NB_OF_PAGES / 2) * AT91C_IFLASH_PAGE_SIZE / sizeof(uint32_t);
 229                     }
 230                     for (int i = 0 + (64 * j); i < 64 + (64 * j); i++) {
 231                         _flash_start[offset + i] = c->d.asDwords[i];
 232                     }
 233
 234                     /* Check that the address that we are supposed to write to is within our allowed region */
 235                     if (((flash_address + AT91C_IFLASH_PAGE_SIZE - 1) >= end_addr) || (flash_address < start_addr)) {
 236                         /* Disallow write */
 237                         ack = false;
 238                         reply_old(CMD_NACK, 0, 0, 0, 0, 0);
 239                     } else {
 240
 241                         efc_bank->EFC_FCR = MC_FLASH_COMMAND_KEY |
 242                                             MC_FLASH_COMMAND_PAGEN(page_n) |
 243                                             AT91C_MC_FCMD_START_PROG;
 244                     }
 245
 246                     // Wait until flashing of page finishes
 247                     uint32_t sr;
 248                     while (!((sr = efc_bank->EFC_FSR) & AT91C_MC_FRDY));
 249                     if (sr & (AT91C_MC_LOCKE | AT91C_MC_PROGE)) {
 250                         ack = false;
 251                         reply_old(CMD_NACK, sr, 0, 0, 0, 0);
 252                     }
 253                 }
 254 #if defined ICOPYX
 255             }
 256 #endif
 257         }
 258         break;
 259
 260         case CMD_HARDWARE_RESET: {
 261             usb_disable();
 262             AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
 263         }
 264         break;
 265
 266         case CMD_START_FLASH: {
 267             if (c->arg[2] == START_FLASH_MAGIC)
 268                 bootrom_unlocked = true;
 269             else
 270                 bootrom_unlocked = false;
 271
 272             uint32_t cmd_start = c->arg[0];
 273             uint32_t cmd_end = c->arg[1];
 274
 275             /* Only allow command if the bootrom is unlocked, or the parameters are outside of the protected
 276             * bootrom area. In any case they must be within the flash area.
 277             */
 278             if ((bootrom_unlocked || ((cmd_start >= (uint32_t)_bootrom_end) || (cmd_end < (uint32_t)_bootrom_start))) &&
 279                     (cmd_start >= (uint32_t)_flash_start) &&
 280                     (cmd_end <= (uint32_t)_flash_end)) {
 281                 start_addr = cmd_start;
 282                 end_addr = cmd_end;
 283             } else {
 284                 start_addr = end_addr = 0;
 285                 ack = false;
 286                 reply_old(CMD_NACK, 0, 0, 0, 0, 0);
 287             }
 288         }
 289         break;
 290
 291         default: {
 292             Fatal();
 293         }
 294         break;
 295     }
 296
 297     if (ack) {
 298         reply_old(CMD_ACK, arg0, 0, 0, 0, 0);
 299     }
 300 }
 301
 302 // delay_loop(1) = 3.07us
 303 static volatile uint32_t ccc;
 304 static void __attribute__((optimize("O0"))) delay_loop(uint32_t delay) {
 305     for (ccc = delay * 2; ccc; ccc--) {};
 306 }
 307
 308 static void flash_mode(void) {
 309     start_addr = 0;
 310     end_addr = 0;
 311     bootrom_unlocked = false;
 312     uint8_t rx[sizeof(PacketCommandOLD)];
 313     g_common_area.command = COMMON_AREA_COMMAND_NONE;
 314     if (!g_common_area.flags.button_pressed && BUTTON_PRESS()) {
 315         g_common_area.flags.button_pressed = 1;
 316     }
 317
 318 #ifdef WITH_FLASH
 319     if (FlashInit()) { // checks for existence of flash also ... OK because bootrom was built for devices with flash
 320         uint64_t flash_uniqueID = 0;
 321         Flash_UniqueID((uint8_t *)&flash_uniqueID);
 322         FlashStop();
 323         usb_update_serial(flash_uniqueID);
 324     }
 325 #endif
 326
 327     usb_enable();
 328
 329     // wait for reset to be complete?
 330     delay_loop(100000);
 331
 332     for (;;) {
 333         WDT_HIT();
 334
 335         // Check if there is a usb packet available
 336         if (usb_poll_validate_length()) {
 337             if (usb_read(rx, sizeof(rx))) {
 338                 UsbPacketReceived(rx);
 339             }
 340         }
 341
 342         bool button_state = BUTTON_PRESS();
 343         // ~10ms, prevent jitter
 344         delay_loop(3333);
 345         if (button_state != BUTTON_PRESS()) {
 346             // in jitter state, ignore
 347             continue;
 348         }
 349         if (g_common_area.flags.button_pressed && button_state == false) {
 350             g_common_area.flags.button_pressed = 0;
 351         }
 352         if (!g_common_area.flags.button_pressed && button_state) {
 353             /* Perform a reset to leave flash mode */
 354             g_common_area.flags.button_pressed = 1;
 355             usb_disable();
 356             LED_B_ON();
 357             AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
 358             for (;;) {};
 359         }
 360     }
 361 }
 362
 363 void BootROM(void);
 364 void BootROM(void) {
 365     /* Set up (that is: clear) BSS. */
 366     uint32_t *bss_dst = __bss_start__;
 367     while (bss_dst < __bss_end__) *bss_dst++ = 0;
 368
 369     //------------
 370     // First set up all the I/O pins; GPIOs configured directly, other ones
 371     // just need to be assigned to the appropriate peripheral.
 372
 373     // Kill all the pullups, especially the one on USB D+; leave them for
 374     // the unused pins, though.
 375     AT91C_BASE_PIOA->PIO_PPUDR =
 376         GPIO_USB_PU         |
 377         GPIO_LED_A          |
 378         GPIO_LED_B          |
 379         GPIO_LED_C          |
 380         GPIO_LED_D          |
 381         GPIO_FPGA_DIN       |
 382         GPIO_FPGA_DOUT      |
 383         GPIO_FPGA_CCLK      |
 384         GPIO_FPGA_NINIT     |
 385         GPIO_FPGA_NPROGRAM  |
 386         GPIO_FPGA_DONE      |
 387         GPIO_MUXSEL_HIPKD   |
 388         GPIO_MUXSEL_HIRAW   |
 389         GPIO_MUXSEL_LOPKD   |
 390         GPIO_MUXSEL_LORAW   |
 391         GPIO_RELAY          |
 392         GPIO_NVDD_ON;
 393     // (and add GPIO_FPGA_ON)
 394     // These pins are outputs
 395     AT91C_BASE_PIOA->PIO_OER =
 396         GPIO_LED_A          |
 397         GPIO_LED_B          |
 398         GPIO_LED_C          |
 399         GPIO_LED_D          |
 400         GPIO_RELAY          |
 401         GPIO_NVDD_ON;
 402     // PIO controls the following pins
 403     AT91C_BASE_PIOA->PIO_PER =
 404         GPIO_USB_PU         |
 405         GPIO_LED_A          |
 406         GPIO_LED_B          |
 407         GPIO_LED_C          |
 408         GPIO_LED_D;
 409
 410     // USB_D_PLUS_PULLUP_OFF();
 411     usb_disable();
 412     LED_D_OFF();
 413     LED_C_ON();
 414     LED_B_OFF();
 415     LED_A_OFF();
 416
 417     // Set the first 256KB memory flashspeed
 418     AT91C_BASE_EFC0->EFC_FMR = AT91C_MC_FWS_1FWS | MC_FLASH_MODE_MASTER_CLK_IN_MHZ(48);
 419
 420     // 9 = 256, 10+ is 512KB
 421     uint8_t id = (*(AT91C_DBGU_CIDR) & 0xF00) >> 8;
 422     if (id > 9)
 423         AT91C_BASE_EFC1->EFC_FMR = AT91C_MC_FWS_1FWS | MC_FLASH_MODE_MASTER_CLK_IN_MHZ(48);
 424
 425     // Initialize all system clocks
 426     ConfigClocks();
 427
 428     LED_A_ON();
 429
 430     int g_common_area_present = 0;
 431     switch (AT91C_BASE_RSTC->RSTC_RSR & AT91C_RSTC_RSTTYP) {
 432         case AT91C_RSTC_RSTTYP_WATCHDOG:
 433         case AT91C_RSTC_RSTTYP_SOFTWARE:
 434         case AT91C_RSTC_RSTTYP_USER:
 435             /* In these cases the g_common_area in RAM should be ok, retain it if it's there */
 436             if (g_common_area.magic == COMMON_AREA_MAGIC && g_common_area.version == 1)
 437                 g_common_area_present = 1;
 438             break;
 439         default: /* Otherwise, initialize it from scratch */
 440             break;
 441     }
 442
 443     if (!g_common_area_present) {
 444         /* Common area not ok, initialize it */
 445         size_t i;
 446         /* Makeshift memset, no need to drag util.c into this */
 447         for (i = 0; i < sizeof(g_common_area); i++)
 448             ((char *)&g_common_area)[i] = 0;
 449
 450         g_common_area.magic = COMMON_AREA_MAGIC;
 451         g_common_area.version = 1;
 452     }
 453     g_common_area.flags.bootrom_present = 1;
 454
 455     if ((g_common_area.command == COMMON_AREA_COMMAND_ENTER_FLASH_MODE) ||
 456             (!g_common_area.flags.button_pressed && BUTTON_PRESS()) ||
 457             (*_osimage_entry == 0xffffffffU)) {
 458         flash_mode();
 459     } else {
 460         // clear button status, even if button still pressed
 461         g_common_area.flags.button_pressed = 0;
 462         // jump to Flash address of the osimage entry point (LSBit set for thumb mode)
 463         __asm("bx %0\n" : : "r"(((uint32_t)_osimage_entry) | 0x1));
 464     }
 465 }