New bootrom

+ Add common area at end of RAM to communicate between main os and bootrom
+ Lower stack end to make room for common area
+ Implement CMD_DEVICE_INFO in both OS and bootrom to give information about the current state and supported features
+ Allow hands-free firmware update: When CMD_START_FLASH is received over USB in OS mode, the device will reset and enter the bootrom
  Pressing the button in hands-free update mode takes precedence: releasing the button will immediately abort firmware update and 
  perform a reset. Do not press the button.
+ Require each flash sequence to be preceded by a CMD_START_FLASH to set up the boundaries for the following flash sequence
  Not compatible with linux flasher before SVN revision 200
  Currently no compatible flasher for Windows. WINDOWS USERS: DO NOT UPDATE YOUR BOOTROM YET
+ Protect bootrom flash area unless magic unlock sequence is given in CMD_START_FLASH

armsrc/appmain.c

@@ -13,7 +13,6 @@
 #include "LCD.h"
 #endif
 
-
 //=============================================================================
 // A buffer where we can queue things up to be sent through the FPGA, for
 // any purpose (fake tag, as reader, whatever). We go MSB first, since that
@@ -23,6 +22,7 @@
 BYTE ToSend[256];
 int ToSendMax;
 static int ToSendBit;
+struct common_area common_area __attribute__((section(".commonarea")));
 
 void BufferClear(void)
 {
@@ -669,7 +669,23 @@ void UsbPacketReceived(BYTE *packet, int len)
 				// We're going to reset, and the bootrom will take control.
 			}
 			break;
+		case CMD_START_FLASH:
+			if(common_area.flags.bootrom_present) {
+				common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE;
+			}
+			USB_D_PLUS_PULLUP_OFF();
+			RSTC_CONTROL = RST_CONTROL_KEY | RST_CONTROL_PROCESSOR_RESET;
+			for(;;);
+			break;
 			
+		case CMD_DEVICE_INFO: {
+			UsbCommand c;
+			c.cmd = CMD_DEVICE_INFO;
+			c.ext1 = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS;
+			if(common_area.flags.bootrom_present) c.ext1 |= DEVICE_INFO_FLAG_BOOTROM_PRESENT;
+			UsbSendPacket((BYTE*)&c, sizeof(c));
+		}
+			break;
 		default:
 			DbpString("unknown command");
 			break;
@@ -681,6 +697,14 @@ void AppMain(void)
 	memset(BigBuf,0,sizeof(BigBuf));
 	SpinDelay(100);
 	
+	if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) {
+		/* Initialize common area */
+		memset(&common_area, 0, sizeof(common_area));
+		common_area.magic = COMMON_AREA_MAGIC;
+		common_area.version = 1;
+	}
+	common_area.flags.osimage_present = 1;
+
 	LED_D_OFF();
 	LED_C_OFF();
 	LED_B_OFF();

armsrc/ldscript

@@ -22,4 +22,8 @@ SECTIONS
 	__bss_start__ = .;
 	.bss : { *(.bss) } >ram
 	__bss_end__ = .;
+
+    	.commonarea (NOLOAD) : {
+    		*(.commonarea)
+    	} >commonarea
 }

bootrom/Makefile

@@ -5,6 +5,13 @@ ARMSRC = fromflash.c
 THUMBSRC = usb.c bootrom.c
 ASMSRC = ram-reset.s flash-reset.s
 
+## There is a strange bug with the linker: Sometimes it will not emit the glue to call
+## BootROM from ARM mode. The symbol is emitted, but the section will be filled with
+## zeroes. As a temporary workaround, do not use thumb for the phase 2 bootloader
+## -- Henryk Plötz <henryk@ploetzli.ch> 2009-09-01
+ARMSRC := $(ARMSRC) $(THUMBSRC)
+THUMBSRC := 
+
 # Do not move this inclusion before the definition of {THUMB,ASM,ARM}SRC
 include ../common/Makefile.common
 

bootrom/bootrom.c

@@ -1,5 +1,9 @@
 #include <proxmark3.h>
 
+struct common_area common_area __attribute__((section(".commonarea")));
+unsigned int start_addr, end_addr, bootrom_unlocked; 
+extern char _bootrom_start, _bootrom_end, _flash_start, _flash_end;
+
 static void ConfigClocks(void)
 {
     // we are using a 16 MHz crystal as the basis for everything
@@ -63,7 +67,7 @@ static void Fatal(void)
 
 void UsbPacketReceived(BYTE *packet, int len)
 {
-    int i;
+    int i, dont_ack=0;
     UsbCommand *c = (UsbCommand *)packet;
     volatile DWORD *p;
 
@@ -73,29 +77,76 @@ void UsbPacketReceived(BYTE *packet, int len)
 
     switch(c->cmd) {
         case CMD_DEVICE_INFO:
+            dont_ack = 1;
+            c->cmd = CMD_DEVICE_INFO;
+            c->ext1 = DEVICE_INFO_FLAG_BOOTROM_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM | 
+                DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH;
+            if(common_area.flags.osimage_present) c->ext1 |= DEVICE_INFO_FLAG_OSIMAGE_PRESENT;
+            UsbSendPacket(packet, len);
             break;
 
         case CMD_SETUP_WRITE:
-            p = (volatile DWORD *)0;
+            /* The temporary write buffer of the embedded flash controller is mapped to the
+             * whole memory region, only the last 8 bits are decoded.
+             */
+            p = (volatile DWORD *)&_flash_start;
             for(i = 0; i < 12; i++) {
                 p[i+c->ext1] = c->d.asDwords[i];
             }
             break;
 
         case CMD_FINISH_WRITE:
-            p = (volatile DWORD *)0;
+            p = (volatile DWORD *)&_flash_start;
             for(i = 0; i < 4; i++) {
                 p[i+60] = c->d.asDwords[i];
             }
 
+            /* Check that the address that we are supposed to write to is within our allowed region */
+            if( ((c->ext1+FLASH_PAGE_SIZE_BYTES-1) >= end_addr) || (c->ext1 < start_addr) ) {
+                /* Disallow write */
+                dont_ack = 1;
+                c->cmd = CMD_NACK;
+                UsbSendPacket(packet, len);
+            } else {
+                /* Translate address to flash page and do flash, update here for the 512k part */
                 MC_FLASH_COMMAND = MC_FLASH_COMMAND_KEY |
-                MC_FLASH_COMMAND_PAGEN(c->ext1/FLASH_PAGE_SIZE_BYTES) |
+                    MC_FLASH_COMMAND_PAGEN((c->ext1-(int)&_flash_start)/FLASH_PAGE_SIZE_BYTES) |
                     FCMD_WRITE_PAGE;
+            }
             while(!(MC_FLASH_STATUS & MC_FLASH_STATUS_READY))
                 ;
             break;
 
         case CMD_HARDWARE_RESET:
+            USB_D_PLUS_PULLUP_OFF();
+            RSTC_CONTROL = RST_CONTROL_KEY | RST_CONTROL_PROCESSOR_RESET;
+            break;
+        
+        case CMD_START_FLASH:
+            if(c->ext3 == START_FLASH_MAGIC) bootrom_unlocked = 1;
+            else bootrom_unlocked = 0;
+            {
+                int prot_start = (int)&_bootrom_start;
+                int prot_end = (int)&_bootrom_end;
+                int allow_start = (int)&_flash_start;
+                int allow_end = (int)&_flash_end;
+                int cmd_start = c->ext1;
+                int cmd_end = c->ext2;
+                
+                /* Only allow command if the bootrom is unlocked, or the parameters are outside of the protected
+                 * bootrom area. In any case they must be within the flash area.
+                 */
+                if( (bootrom_unlocked || ((cmd_start >= prot_end) || (cmd_end < prot_start)))
+                    && (cmd_start >= allow_start) && (cmd_end <= allow_end) ) {
+                    start_addr = cmd_start;
+                    end_addr = cmd_end;
+                } else {
+                    start_addr = end_addr = 0;
+                    dont_ack = 1;
+                    c->cmd = CMD_NACK;
+                    UsbSendPacket(packet, len);
+                }
+            }
             break;
         
         default:
@@ -103,8 +154,36 @@ void UsbPacketReceived(BYTE *packet, int len)
             break;
     }
 
+    if(!dont_ack) {
         c->cmd = CMD_ACK;
         UsbSendPacket(packet, len);
+    }
+}
+
+static void flash_mode(int externally_entered)
+{
+	start_addr = 0;
+	end_addr = 0;
+	bootrom_unlocked = 0;
+	
+	UsbStart();
+	for(;;) {
+		WDT_HIT();
+		
+		UsbPoll(TRUE);
+		
+		if(!externally_entered && !BUTTON_PRESS()) {
+			/* Perform a reset to leave flash mode */
+			USB_D_PLUS_PULLUP_OFF();
+			LED_B_ON();
+			RSTC_CONTROL = RST_CONTROL_KEY | RST_CONTROL_PROCESSOR_RESET;
+			for(;;);
+		}
+		if(externally_entered && BUTTON_PRESS()) {
+			/* Let the user's button press override the automatic leave */
+			externally_entered = 0;
+		}
+	}
 }
 
 extern char _osimage_entry;
@@ -170,21 +249,38 @@ void BootROM(void)
     
     LED_A_ON();
     
-	if(BUTTON_PRESS()) {
+    int common_area_present = 0;
-    	UsbStart();
+    switch(RSTC_STATUS & RST_STATUS_TYPE_MASK) {
+    case RST_STATUS_TYPE_WATCHDOG:
+    case RST_STATUS_TYPE_SOFTWARE:
+    case RST_STATUS_TYPE_USER:
+	    /* In these cases the common_area in RAM should be ok, retain it if it's there */
+	    if(common_area.magic == COMMON_AREA_MAGIC && common_area.version == 1) {
+		    common_area_present = 1;
+	    }
+	    break;
+    default: /* Otherwise, initialize it from scratch */
+	    break;
     }
     
-    for(;;) {
+    if(!common_area_present){
-        WDT_HIT();
+	    /* Common area not ok, initialize it */
-
+	    int i; for(i=0; i<sizeof(common_area); i++) { /* Makeshift memset, no need to drag util.c into this */
-        UsbPoll(TRUE);
+		    ((char*)&common_area)[i] = 0;
-
+	    }
-		if(!BUTTON_PRESS()) {
+	    common_area.magic = COMMON_AREA_MAGIC;
-            USB_D_PLUS_PULLUP_OFF();
+	    common_area.version = 1;
-            LED_B_ON();
+	    common_area.flags.bootrom_present = 1;
+    }
     
+    common_area.flags.bootrom_present = 1;
+    if(common_area.command == COMMON_AREA_COMMAND_ENTER_FLASH_MODE) {
+	    common_area.command = COMMON_AREA_COMMAND_NONE;
+	    flash_mode(1);
+    } else if(BUTTON_PRESS()) {
+	    flash_mode(0);
+    } else {
 	    // jump to Flash address of the osimage entry point (LSBit set for thumb mode)
 	    asm("bx %0\n" : : "r" ( ((int)&_osimage_entry) | 0x1 ) );
     }
-    }
 }

bootrom/ldscript-flash

@@ -45,4 +45,8 @@ SECTIONS
     
     . = ALIGN( 32 / 8 );
     __bss_end__ = .;
+    
+    .commonarea (NOLOAD) : {
+    	*(.commonarea)
+    } >commonarea
 }

common/Makefile.common

@@ -39,10 +39,11 @@ DETECTED_OS=Windows
 
 endif
 
-CC	= arm-elf-gcc
+CROSS   = arm-elf-
-AS	= arm-elf-as
+CC	= $(CROSS)gcc
-LD	= arm-elf-ld
+AS	= $(CROSS)as
-OBJCOPY = arm-elf-objcopy
+LD	= $(CROSS)ld
+OBJCOPY = $(CROSS)objcopy
 
 OBJDIR	= obj
 
@@ -78,8 +79,8 @@ $(VERSIONOBJ): $(OBJDIR)/%.o: %.c $(INCLUDES)
 $(OBJDIR)/%.s19: $(OBJDIR)/%.elf
 	$(OBJCOPY) -Osrec --srec-forceS3 --strip-debug --no-change-warnings \
 	--change-addresses -0x100000 --change-start 0 \
-	--change-section-address .bss+0 \
+	--change-section-address .bss+0 --change-section-address .data+0 \
-	--change-section-address .data+0 $^ $@
+	--change-section-address .commonarea+0 $^ $@
 
 # version.c should be remade on every compilation
 .PHONY: version.c

common/ldscript.common

@@ -11,12 +11,15 @@ MEMORY
         bootphase2 : ORIGIN = 0x00100200, LENGTH = 0x2000 - 0x200 /* Main bootloader code, stored in Flash, executed from RAM */
         fpgaimage  : ORIGIN = 0x00102000, LENGTH = 64k - 0x2000 /* Place where the FPGA image will end up */
         osimage    : ORIGIN = 0x00110000, LENGTH = 256K - 64k /* Place where the main OS will end up */
-        ram        : ORIGIN = 0x00200000, LENGTH = 64K
+        ram        : ORIGIN = 0x00200000, LENGTH = 64K - 0x20 /* RAM, minus small common area */
+        commonarea : ORIGIN = 0x00200000 + 64K - 0x20, LENGTH = 0x20 /* Communication between bootloader and main OS */
 }
 
 /* Export some information that can be used from within the firmware */
 _bootphase1_version_pointer = ORIGIN(bootphase1) + LENGTH(bootphase1) - 0x4;
 _osimage_entry = ORIGIN(osimage);
+_bootrom_start = ORIGIN(bootphase1);
+_bootrom_end = ORIGIN(bootphase2) + LENGTH(bootphase2);
 _flash_start = ORIGIN(bootphase1);
 _flash_end = ORIGIN(osimage) + LENGTH(osimage);
 _stack_end = ORIGIN(ram) + LENGTH(ram) - 8;

include/proxmark3.h

@@ -70,4 +70,18 @@ struct version_information {
 	char buildtime[30]; /* string with the build time */
 } __attribute__((packed));
 
+#define COMMON_AREA_MAGIC 0x43334d50
+#define COMMON_AREA_COMMAND_NONE 0
+#define COMMON_AREA_COMMAND_ENTER_FLASH_MODE 1
+struct common_area {
+	int magic; /* Magic sequence, to distinguish against random uninitialized memory */
+	char version; /* Must be 1 */
+	char command;
+	struct {
+		unsigned int bootrom_present:1; /* Set when a bootrom that is capable of parsing the common area is present */
+		unsigned int osimage_present:1; /* Set when a osimage that is capable of parsing the common area is present */
+	} __attribute__((packed)) flags;
+	int arg1, arg2;
+} __attribute__((packed));
+
 #endif