| /* |
| * Copyright 2015 Google Inc. |
| * |
| * This program is free software; you can redistribute it and/or modify |
| * it under the terms of the GNU General Public License as published by |
| * the Free Software Foundation; version 2 of the License. |
| * |
| * This program is distributed in the hope that it will be useful, |
| * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| * GNU General Public License for more details. |
| */ |
| |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| |
| #include "em100.h" |
| |
| /* Firmware Update File Format |
| * =========================== |
| * |
| * 0x0000000: 65 6d 31 30 30 70 72 6f - magic (20 bytes) |
| * 0x0000014: 32 2e 32 36 - version MCU (10 bytes) |
| * 0x000001e: 30 2e 37 35 - version FPGA (10 bytes) |
| * 0x0000028: 57 46 50 44 - Rev / WFPD (16 bytes) |
| * 0x0000038: 00 01 00 00 - file offset FPGA (4 bytes) |
| * 0x000003c: 44 15 07 00 - file length FPGA (4 bytes) |
| * 0x0000040: 00 17 07 00 - file offset MCU (4 bytes) |
| * 0x0000044: 00 bf 00 00 - file length MCU (4 bytes) |
| * |
| * EM100Pro / EM100Pro-G2 Flash Layout |
| * =================================== |
| * |
| * 0x0000000: fpga firmware |
| * 0x0100000: 256 bytes of 0x00 filled space |
| * 0x0100100: mcu firmware |
| * 0x01f0000: 4 bytes secret key, 00 padded |
| * 0x01fff00: ff xx yy yy yy yy ff ff |
| * xx: HW version (0xff, 0x04, 0x06) |
| * yy: 4 bytes serial number |
| * |
| * Notes |
| * ===== |
| * |
| * - Empty pages remain 0xff filled. |
| * - Partially used pages are typically filled up with 00 bytes |
| * except the page containing the serial number. |
| * - After a FPGA firmware update, the page at 0x0100000 needs to |
| * be written with 0xaa 0x55 BOOT 0x55 0xaa to make the FPGA |
| * slurp in the new firmware. |
| */ |
| |
| #undef DEBUG |
| |
| static void print_progress(int percent) |
| { |
| int i; |
| |
| putchar('\r'); |
| putchar('['); |
| for (i = 0; i < percent / 2; i++) |
| putchar('='); |
| for (i = 0; i < 50 - (percent / 2); i++) |
| putchar(' '); |
| putchar(']'); |
| if (percent == 100) |
| putchar('\n'); |
| fflush(stdout); |
| } |
| |
| static uint32_t get_le32(const unsigned char *in) |
| { |
| return (in[3] << 24) | (in[2] << 16) | (in[1] << 8) | (in[0] << 0); |
| } |
| |
| static void put_le32(unsigned char *out, uint32_t val) |
| { |
| out[0] = val&0xff; |
| out[1] = (val>>8)&0xff; |
| out[2] = (val>>16)&0xff; |
| out[3] = (val>>24)&0xff; |
| } |
| |
| int firmware_dump(struct em100 *em100, const char *filename, |
| int firmware_is_dpfw) |
| { |
| unsigned char *data; |
| size_t i, rom_size = 0; |
| uint32_t id; |
| FILE *fw; |
| |
| id = get_spi_flash_id(em100); |
| switch (id) { |
| case 0x202015: |
| rom_size = 2 MB; |
| break; |
| default: |
| printf("Unknown SPI flash id = %06x. Please report\n", id); |
| return 1; |
| } |
| data = malloc(rom_size); |
| if (data == NULL) { |
| perror("Out of memory.\n"); |
| exit(1); |
| } |
| memset(data, 0, rom_size); |
| |
| printf("\nWriting EM100Pro firmware to file %s\n", filename); |
| for (i=0; i < rom_size; i+=256) { |
| if((i & 0x7fff) == 0) |
| print_progress(i * 100 / rom_size); |
| if (!read_spi_flash_page(em100, i, data+i)) { |
| if (!read_spi_flash_page(em100, i, data+i)) |
| if (!read_spi_flash_page(em100, i, data+i)) |
| printf("\nERROR: Couldn't read @%08zx\n", |
| i); |
| } |
| } |
| print_progress(100); |
| fw = fopen(filename, "wb"); |
| if (!fw) { |
| perror(filename); |
| free(data); |
| return 0; |
| } |
| |
| if (firmware_is_dpfw) { |
| int fpga_size = 0, mcu_size = 0, hdrversion = 0; |
| char all_ff[256]; |
| char mcu_version[8]; |
| char fpga_version[8]; |
| unsigned char header[0x100]; |
| |
| switch (em100->hwversion) { |
| case HWVERSION_EM100PRO_EARLY: |
| case HWVERSION_EM100PRO: |
| hdrversion=1; |
| break; |
| case HWVERSION_EM100PRO_G2: |
| hdrversion=2; |
| break; |
| default: |
| printf("Dumping DPFW firmware on hardware version %u is " |
| "not yet supported.\n", em100->hwversion); |
| exit(1); |
| } |
| |
| memset(all_ff, 255, sizeof(all_ff)); |
| for (i = 0; i < 0x100000; i+=0x100) { |
| if (memcmp(data+i, all_ff, 256) == 0) |
| break; |
| } |
| if (i == 0x100000) { |
| printf("Can't parse device firmware. Please extract" |
| " raw firmware instead.\n"); |
| free(data); |
| exit(1); |
| } |
| fpga_size = i; |
| |
| for (i = 0; i < 0xfff00; i+=0x100) { |
| if (memcmp(data+0x100100+i, all_ff, 256) == 0) |
| break; |
| } |
| if (i == 0xfff00) { |
| printf("Can't parse device firmware. Please extract" |
| " raw firmware instead.\n"); |
| free(data); |
| exit(1); |
| } |
| mcu_size = i; |
| |
| snprintf(mcu_version, 8, "%d.%d", |
| em100->mcu >> 8, em100->mcu & 0xff); |
| snprintf(fpga_version, 8, "%d.%d", |
| em100->fpga >> 8 & 0x7f, em100->fpga & 0xff); |
| |
| memset(header, 0, 0x100); |
| switch (hdrversion) { |
| case 1: |
| memcpy(header, "em100pro", 8); |
| break; |
| case 2: |
| memcpy(header, "EM100Pro-G2", 11); |
| break; |
| } |
| memcpy(header + 0x28, "WFPD", 4); |
| memcpy(header + 0x14, mcu_version, 4); |
| memcpy(header + 0x1e, fpga_version, 4); |
| put_le32(header + 0x38, 0x100); |
| put_le32(header + 0x3c, fpga_size); |
| put_le32(header + 0x40, 0x100 + fpga_size); |
| put_le32(header + 0x44, 0x100 + mcu_size); |
| fwrite(header, 0x100, 1, fw); |
| fwrite(data, fpga_size, 1, fw); |
| fwrite(data + 0x100100, mcu_size, 1, fw); |
| } else { |
| if (fwrite(data, rom_size, 1, fw) != 1) |
| printf("ERROR: Couldn't write %s\n", filename); |
| } |
| fclose(fw); |
| |
| #ifdef DEBUG |
| hexdump(data, rom_size); |
| #endif |
| free(data); |
| return 0; |
| } |
| |
| int firmware_update(struct em100 *em100, const char *filename, int verify) |
| { |
| #define MAX_VERSION_LENGTH 10 |
| unsigned char page[256], vpage[256]; |
| FILE *f; |
| long fsize; |
| unsigned char *fw; |
| int i; |
| int fpga_offset, fpga_len, mcu_offset, mcu_len; |
| char fpga_version[MAX_VERSION_LENGTH + 1], |
| mcu_version[MAX_VERSION_LENGTH + 1]; |
| |
| switch (em100->hwversion) { |
| case HWVERSION_EM100PRO_EARLY: |
| case HWVERSION_EM100PRO: |
| printf("Detected EM100Pro (original).\n"); |
| break; |
| case HWVERSION_EM100PRO_G2: |
| printf("Detected EM100Pro-G2.\n"); |
| break; |
| default: |
| printf("Updating EM100Pro firmware on hardware version %u is " |
| "not yet supported.\n", em100->hwversion); |
| exit(1); |
| } |
| |
| printf("\nAttempting firmware update with file %s\n", filename); |
| |
| f = fopen(filename, "rb"); |
| if (!f) { |
| perror(filename); |
| return 0; |
| } |
| |
| fseek(f, 0, SEEK_END); |
| fsize = ftell(f); |
| if (fsize < 0) { |
| perror(filename); |
| fclose(f); |
| return 0; |
| } |
| fseek(f, 0, SEEK_SET); |
| |
| fw = malloc(fsize); |
| if (!fw) { |
| printf("ERROR: out of memory.\n"); |
| fclose(f); |
| return 0; |
| } |
| if (fread(fw, fsize, 1, f) != 1) { |
| perror(filename); |
| fclose(f); |
| free(fw); |
| return 0; |
| } |
| fclose(f); |
| |
| if (em100->hwversion == HWVERSION_EM100PRO_EARLY && (memcmp(fw, "em100pro", 8) != 0 || |
| memcmp(fw + 0x28, "WFPD", 4) != 0)) { |
| printf("ERROR: Not an EM100Pro (original) firmware file.\n"); |
| free(fw); |
| return 0; |
| } |
| |
| if (em100->hwversion == HWVERSION_EM100PRO && (memcmp(fw, "em100pro", 8) != 0 || |
| memcmp(fw + 0x28, "WFPD", 4) != 0)) { |
| printf("ERROR: Not an EM100Pro (original) firmware file.\n"); |
| free(fw); |
| return 0; |
| } |
| |
| if (em100->hwversion == HWVERSION_EM100PRO_G2 && (memcmp(fw, "EM100Pro-G2", 11) != 0 || |
| memcmp(fw + 0x28, "WFPD", 4) != 0)) { |
| printf("ERROR: Not an EM100Pro-G2 firmware file.\n"); |
| free(fw); |
| return 0; |
| } |
| |
| /* Find firmwares in the update file */ |
| fpga_offset = get_le32(fw+0x38); |
| fpga_len = get_le32(fw+0x3c); |
| mcu_offset = get_le32(fw+0x40); |
| mcu_len = get_le32(fw+0x44); |
| |
| /* Extracting versions */ |
| strncpy(mcu_version, (char *)fw + 0x14, MAX_VERSION_LENGTH); |
| mcu_version[MAX_VERSION_LENGTH] = '\0'; |
| strncpy(fpga_version, (char *)fw + 0x1e, MAX_VERSION_LENGTH); |
| fpga_version[MAX_VERSION_LENGTH] = '\0'; |
| |
| printf("EM100Pro%s Update File: %s\n", |
| em100->hwversion == HWVERSION_EM100PRO_G2 ? "-G2" : "", filename); |
| if (em100->hwversion == HWVERSION_EM100PRO) |
| printf(" Installed version: MCU %d.%d, FPGA %d.%d (%s)\n", |
| em100->mcu >> 8, em100->mcu & 0xff, |
| em100->fpga >> 8 & 0x7f, em100->fpga & 0xff, |
| em100->fpga & 0x8000 ? "1.8V" : "3.3V"); |
| else |
| printf(" Installed version: MCU %d.%d, FPGA %d.%03d\n", |
| em100->mcu >> 8, em100->mcu & 0xff, |
| em100->fpga >> 8 & 0x7f, em100->fpga & 0xff); |
| |
| printf(" New version: MCU %s, FPGA %s\n", |
| mcu_version, fpga_version); |
| |
| if (fpga_len < 256 || mcu_len < 256 || |
| fpga_len > 0x100000 || mcu_len > 0xf0000) { |
| printf("\nFirmware file not valid.\n"); |
| free(fw); |
| return 0; |
| } |
| |
| /* Unlock and erase sector. Reading |
| * the SPI flash ID is requires to |
| * actually unlock the chip. |
| */ |
| unlock_spi_flash(em100); |
| get_spi_flash_id(em100); |
| |
| printf("Erasing firmware:\n"); |
| for (i=0; i<=0x1e; i++) { |
| print_progress(i * 100 / 0x1e); |
| erase_spi_flash_sector(em100, i); |
| } |
| get_spi_flash_id(em100); // Needed? |
| |
| printf("Writing firmware:\n"); |
| |
| /* Writing FPGA firmware */ |
| for (i = 0; i < fpga_len; i += 256) { |
| memset(page, 0xff, 256); |
| memcpy(page, fw + fpga_offset + i, fpga_len - i |
| > 256 ? 256 : fpga_len - i); |
| write_spi_flash_page(em100, i, page); |
| if ((i & 0xfff) == 0) |
| print_progress((i * 100) / (fpga_len + mcu_len)); |
| } |
| |
| /* Writing MCU firmware */ |
| for (i = 0; i < mcu_len; i += 256) { |
| memset(page, 0xff, 256); |
| memcpy(page, fw + mcu_offset + i, (mcu_len - i) |
| > 256 ? 256 : mcu_len - i); |
| write_spi_flash_page(em100, i + 0x100100, page); |
| if ((i & 0xfff) == 0) |
| print_progress(((fpga_len + i) * 100) / |
| (fpga_len + mcu_len)); |
| } |
| print_progress(100); |
| |
| if (verify) { |
| printf("Verifying firmware:\n"); |
| for (i = 0; i < fpga_len; i += 256) { |
| memset(page, 0xff, 256); |
| memcpy(page, fw + fpga_offset + i, fpga_len - i |
| > 256 ? 256 : fpga_len - i); |
| read_spi_flash_page(em100, i, vpage); |
| |
| if ((i & 0xfff) == 0) |
| print_progress((i * 100) / (fpga_len + mcu_len)); |
| if (memcmp(page, vpage, 256)) |
| printf("\nERROR: Could not write FPGA firmware" |
| " (%x).\n", i); |
| } |
| for (i = 0; i < mcu_len; i += 256) { |
| memset(page, 0xff, 256); |
| memcpy(page, fw + mcu_offset + i, mcu_len - i |
| > 256 ? 256 : mcu_len - i); |
| read_spi_flash_page(em100, i + 0x100100, vpage); |
| |
| if ((i & 0xfff) == 0) |
| print_progress(((fpga_len + i) * 100) / |
| (fpga_len + mcu_len)); |
| if (memcmp(page, vpage, 256)) |
| printf("\nERROR: Could not write MCU firmware" |
| " (%x).\n", i); |
| } |
| } |
| print_progress(100); |
| |
| free(fw); |
| |
| /* Write magic update tag '.UBOOTU.' */ |
| memset(page, 0x00, 256); |
| page[0] = 0xaa; |
| page[1] = 0x55; |
| page[2] = 0x42; |
| page[3] = 0x4f; |
| page[4] = 0x4f; |
| page[5] = 0x54; |
| page[6] = 0x55; |
| page[7] = 0xaa; |
| write_spi_flash_page(em100, 0x100000, page); |
| |
| if (verify) { |
| read_spi_flash_page(em100, 0x100000, vpage); |
| if (memcmp(page, vpage, 256)) |
| printf("ERROR: Could not write update tag.\n"); |
| } |
| |
| printf("\nDisconnect and reconnect your EM100pro\n"); |
| |
| return 1; |
| } |