00001
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029
00030
00031
00032
00033
00034
00035
00036
00037
00038
00039
00040
00041
00042
00043
00044
00045
00046
00047
00048
00049
00050 #include "conf_usb.h"
00051
00052
00053 #if USB_DEVICE_FEATURE == ENABLED
00054
00055 #include <avr32/io.h>
00056 #include <stddef.h>
00057 #include <string.h>
00058 #include "compiler.h"
00059 #include "pm.h"
00060
00061 #include "flashc.h"
00062 #include "usb_drv.h"
00063 #include "usb_task.h"
00064 #include "usb_descriptors.h"
00065 #include "usb_dfu.h"
00066 #include "boot.h"
00067 #include "conf_isp.h"
00068 #include "isp.h"
00069
00070
00071
00072
00079 #if LITTLE_ENDIAN_MCU
00080 #define Dfu_format_mcu_to_dfu_data(width, data) (TPASTE2(Swap, width)(data))
00081 #define Dfu_format_dfu_to_mcu_data(width, data) (TPASTE2(Swap, width)(data))
00082 #define dfu_format_mcu_to_dfu_data(width, data) (TPASTE2(swap, width)(data))
00083 #define dfu_format_dfu_to_mcu_data(width, data) (TPASTE2(swap, width)(data))
00084 #else // BIG_ENDIAN_MCU
00085 #define Dfu_format_mcu_to_dfu_data(width, data) ((TPASTE2(U, width))(data))
00086 #define Dfu_format_dfu_to_mcu_data(width, data) ((TPASTE2(U, width))(data))
00087 #define dfu_format_mcu_to_dfu_data(width, data) ((TPASTE2(U, width))(data))
00088 #define dfu_format_dfu_to_mcu_data(width, data) ((TPASTE2(U, width))(data))
00089 #endif
00091
00092
00093
00094 #define CMD_GRP_DNLOAD 0x01
00095 #define CMD_GRP_UPLOAD 0x03
00096 #define CMD_GRP_EXEC 0x04
00097 #define CMD_GRP_SELECT 0x06
00098
00099
00100 #define CMD_PROGRAM_START 0x00
00101
00102
00103 #define CMD_READ_MEMORY 0x00
00104 #define CMD_BLANK_CHECK 0x01
00105
00106
00107 #define CMD_ERASE 0x00
00108 #define CMD_START_APPLI 0x03
00109
00110
00111 #define CMD_SELECT_MEMORY 0x03
00112
00113
00114 #define CMD_ERASE_ARG_CHIP 0xFF
00115
00116
00117 #define CMD_START_APPLI_ARG_RESET 0x00
00118 #define CMD_START_APPLI_ARG_NO_RESET 0x01
00119
00120
00121 #define CMD_SELECT_MEMORY_ARG_UNIT 0x00
00122 #define CMD_SELECT_MEMORY_ARG_PAGE 0x01
00123
00124
00125 #define MEM_FLASH 0x00
00126 #define MEM_EEPROM 0x01
00127 #define MEM_SECURITY 0x02
00128 #define MEM_CONFIGURATION 0x03
00129 #define MEM_BOOTLOADER 0x04
00130 #define MEM_SIGNATURE 0x05
00131 #define MEM_USER 0x06
00132
00133
00134 #define MEM_COUNT (MEM_USER + 1)
00135
00136
00137 #define PRODUCT_MANUFACTURER_ID_ADDRESS 0x00
00138 #define PRODUCT_FAMILY_ID_ADDRESS 0x01
00139 #define PRODUCT_ID_ADDRESS 0x02
00140 #define PRODUCT_REVISION_ADDRESS 0x03
00141
00142
00143 #define PRODUCT_INF_ITEM_COUNT (PRODUCT_REVISION_ADDRESS + 1)
00144
00145
00146 #define ISP_VERSION_ADDRESS 0x00
00147 #define ISP_ID0_ADDRESS 0x01
00148 #define ISP_ID1_ADDRESS 0x02
00149
00150
00151 #define ISP_INF_ITEM_COUNT (ISP_ID1_ADDRESS + 1)
00152
00153
00154
00155
00156 static void mem_flash_read(void *dst, U32 src, size_t nbytes);
00157 static void mem_flash_write(U32 dst, const void *src, size_t nbytes);
00158 static void mem_security_read(void *dst, U32 src, size_t nbytes);
00159 static void mem_security_write(U32 dst, const void *src, size_t nbytes);
00160 static void mem_configuration_read(void *dst, U32 src, size_t nbytes);
00161 static void mem_configuration_write(U32 dst, const void *src, size_t nbytes);
00162 static void mem_bootloader_read(void *dst, U32 src, size_t nbytes);
00163 static void mem_signature_read(void *dst, U32 src, size_t nbytes);
00164 static void mem_user_read(void *dst, U32 src, size_t nbytes);
00165 static void mem_user_write(U32 dst, const void *src, size_t nbytes);
00166
00167
00168
00169
00170 typedef union
00171 {
00172 U32 long_address;
00173 struct
00174 {
00175 unsigned int page : 16;
00176 unsigned int page_offset : 16;
00177 };
00178 } address_t;
00179
00180
00181 static U8 PRODUCT_INF[PRODUCT_INF_ITEM_COUNT] =
00182 {
00183 PRODUCT_MANUFACTURER_ID,
00184 PRODUCT_FAMILY_ID
00185 };
00186
00187 static const U8 ISP_INF[ISP_INF_ITEM_COUNT] =
00188 {
00189 ISP_VERSION,
00190 ISP_ID0,
00191 ISP_ID1
00192 };
00193
00194 static address_t MEMORY_END_ADDRESS[MEM_COUNT] =
00195 {
00196
00197 #if (defined __GNUC__) && ((defined __AVR32_UC3B0512__) || \
00198 (defined __AVR32_UC3B1512__)) || \
00199 (defined __ICCAVR32__) && ((defined __AT32UC3B0512__) || \
00200 (defined __AT32UC3B1512__))
00201 #undef AVR32_FLASH_SIZE
00202 #define AVR32_FLASH_SIZE 0x00080000
00203 #endif
00204
00205
00206 {AVR32_FLASH_SIZE - 1},
00207
00208
00209 {0},
00210
00211
00212 {0},
00213
00214
00215 {AVR32_FLASHC_GPF_NUM - 1},
00216
00217
00218 {sizeof(ISP_INF) - 1},
00219
00220
00221 {sizeof(PRODUCT_INF) - 1},
00222
00223
00224 {AVR32_FLASHC_USER_PAGE_SIZE - 1}
00225 };
00226
00227 static const struct
00228 {
00229 void (*read)(void *dst, U32 src, size_t nbytes);
00230 void (*write)(U32 dst, const void *src, size_t nbytes);
00231 } MEMORY_ACCESS[MEM_COUNT] =
00232 {
00233
00234 {
00235 mem_flash_read,
00236 mem_flash_write
00237 },
00238
00239
00240 {
00241 NULL,
00242 NULL
00243 },
00244
00245
00246 {
00247 mem_security_read,
00248 mem_security_write
00249 },
00250
00251
00252 {
00253 mem_configuration_read,
00254 mem_configuration_write
00255 },
00256
00257
00258 {
00259 mem_bootloader_read,
00260 NULL
00261 },
00262
00263
00264 {
00265 mem_signature_read,
00266 NULL
00267 },
00268
00269
00270 {
00271 mem_user_read,
00272 mem_user_write
00273 }
00274 };
00275
00276 static const U8 MEMORY_ERASE_VALUE[MEM_COUNT] =
00277 {
00278
00279 0xFF,
00280
00281
00282 0xFF,
00283
00284
00285 0x00,
00286
00287
00288 0x01,
00289
00290
00291 0x00,
00292
00293
00294 0x00,
00295
00296
00297 0xFF
00298 };
00299
00300 static Bool security_active = TRUE;
00301 static S32 length;
00302 static U8 cmd_group = CMD_GRP_EXEC;
00303 static U8 cmd = CMD_START_APPLI;
00304 static U8 memory = MEM_FLASH;
00305 static address_t start_address;
00306 static address_t end_address;
00307 static U32 data_bytes;
00308 static U8 dfu_frame[DFU_FRAME_LENGTH];
00309 static U8 dfu_status = STATUS_OK;
00310
00311 U8 usb_dfu_status = STATUS_OK;
00312 U8 usb_dfu_state = STATE_dfuIDLE;
00313
00314
00315 static Bool is_isp_forced(void)
00316 {
00317 return flashc_read_gp_fuse_bit(ISP_GPFB_FORCE_OFFSET);
00318 }
00319
00320
00321 static void force_isp(Bool force)
00322 {
00323 flashc_set_gp_fuse_bit(ISP_GPFB_FORCE_OFFSET, force);
00324 }
00325
00326
00327 static Bool get_and_check_mem_range(void)
00328 {
00329 start_address.page_offset = Usb_read_endpoint_data(EP_CONTROL, 16);
00330 start_address.page_offset = dfu_format_dfu_to_mcu_data(16, start_address.page_offset);
00331 end_address.page_offset = Usb_read_endpoint_data(EP_CONTROL, 16);
00332 end_address.page_offset = dfu_format_dfu_to_mcu_data(16, end_address.page_offset);
00333
00334 if (end_address.long_address < start_address.long_address ||
00335 end_address.long_address > MEMORY_END_ADDRESS[memory].long_address)
00336 {
00337 dfu_status = STATUS_errADDRESS;
00338 return FALSE;
00339 }
00340
00341 data_bytes = end_address.long_address - start_address.long_address + 1;
00342 return TRUE;
00343 }
00344
00345
00346 static void mem_flash_read(void *dst, U32 src, size_t nbytes)
00347 {
00348 memcpy(dst, AVR32_FLASH + src, nbytes);
00349 }
00350
00351
00352 static void mem_flash_write(U32 dst, const void *src, size_t nbytes)
00353 {
00354 flashc_memcpy(AVR32_FLASH + dst, src, nbytes, FALSE);
00355 }
00356
00357
00358 static void mem_security_read(void *dst, U32 src, size_t nbytes)
00359 {
00360 if (nbytes)
00361 *(U8 *)dst = flashc_is_security_bit_active();
00362 }
00363
00364
00365 static void mem_security_write(U32 dst, const void *src, size_t nbytes)
00366 {
00367 if (nbytes && *(U8 *)src)
00368 {
00369 security_active = TRUE;
00370 flashc_activate_security_bit();
00371 }
00372 }
00373
00374
00375 static void mem_configuration_read(void *dst, U32 src, size_t nbytes)
00376 {
00377 U8 *dest = dst;
00378 while (nbytes--)
00379 *dest++ = flashc_read_gp_fuse_bit(src++);
00380 }
00381
00382
00383 static void mem_configuration_write(U32 dst, const void *src, size_t nbytes)
00384 {
00385 const U8 *source = src;
00386 while (nbytes--)
00387 flashc_set_gp_fuse_bit(dst++, *source++);
00388 }
00389
00390
00391 static void mem_bootloader_read(void *dst, U32 src, size_t nbytes)
00392 {
00393 memcpy(dst, ISP_INF + src, nbytes);
00394 }
00395
00396
00397 static void mem_signature_read(void *dst, U32 src, size_t nbytes)
00398 {
00399 memcpy(dst, PRODUCT_INF + src, nbytes);
00400 }
00401
00402
00403 static void mem_user_read(void *dst, U32 src, size_t nbytes)
00404 {
00405 memcpy(dst, (U8 *)AVR32_FLASHC_USER_PAGE + src, nbytes);
00406 }
00407
00408
00409 static void mem_user_write(U32 dst, const void *src, size_t nbytes)
00410 {
00411 flashc_memcpy(AVR32_FLASHC_USER_PAGE + dst, src, nbytes, TRUE);
00412 }
00413
00414
00415 static void erase_check_mem(void)
00416 {
00417 U8 *frame;
00418 U32 frame_bytes;
00419
00420 while (data_bytes)
00421 {
00422 frame = dfu_frame;
00423 frame_bytes = min(data_bytes, DFU_FRAME_LENGTH);
00424 data_bytes -= frame_bytes;
00425
00426 MEMORY_ACCESS[memory].read(frame, start_address.long_address, frame_bytes);
00427
00428 while (frame_bytes--)
00429 {
00430 if (*frame++ != MEMORY_ERASE_VALUE[memory])
00431 {
00432 dfu_status = STATUS_errCHECK_ERASED;
00433 return;
00434 }
00435 start_address.long_address++;
00436 }
00437 }
00438 }
00439
00440
00441 static void read_mem(void)
00442 {
00443 void *frame;
00444 U32 frame_bytes;
00445
00446 while (data_bytes)
00447 {
00448 frame = dfu_frame;
00449 frame_bytes = min(data_bytes, DFU_FRAME_LENGTH);
00450 data_bytes -= frame_bytes;
00451
00452 MEMORY_ACCESS[memory].read(frame, start_address.long_address, frame_bytes);
00453 start_address.long_address += frame_bytes;
00454
00455 while (frame_bytes)
00456 {
00457 while (!Is_usb_control_in_ready());
00458
00459 Usb_reset_endpoint_fifo_access(EP_CONTROL);
00460 frame_bytes = usb_write_ep_txpacket(EP_CONTROL, frame, frame_bytes, (const void **)&frame);
00461 Usb_ack_control_in_ready_send();
00462 }
00463 }
00464 }
00465
00466
00467 static void write_mem(void)
00468 {
00469 void *frame;
00470 U32 frame_bytes, unaligned_frame_bytes;
00471
00472 data_bytes += Get_align(start_address.long_address, EP_CONTROL_LENGTH);
00473 length -= EP_CONTROL_LENGTH + Align_up(data_bytes, EP_CONTROL_LENGTH);
00474
00475 while (data_bytes)
00476 {
00477 frame = dfu_frame;
00478 frame_bytes = min(data_bytes, DFU_FRAME_LENGTH);
00479 unaligned_frame_bytes = frame_bytes - Get_align(start_address.long_address, EP_CONTROL_LENGTH);
00480 data_bytes -= frame_bytes;
00481
00482 while (frame_bytes)
00483 {
00484 while (!Is_usb_control_out_received());
00485
00486 Usb_reset_endpoint_fifo_access(EP_CONTROL);
00487 frame_bytes = usb_read_ep_rxpacket(EP_CONTROL, frame, frame_bytes, &frame);
00488 Usb_ack_control_out_received_free();
00489 }
00490
00491 MEMORY_ACCESS[memory].write(start_address.long_address,
00492 dfu_frame + Get_align(start_address.long_address, EP_CONTROL_LENGTH),
00493 unaligned_frame_bytes);
00494 start_address.long_address += unaligned_frame_bytes;
00495 }
00496
00497 while (length > 0)
00498 {
00499 while (!Is_usb_control_out_received());
00500 Usb_ack_control_out_received_free();
00501 length -= EP_CONTROL_LENGTH;
00502 }
00503 }
00504
00505
00506 void usb_dfu_init(void)
00507 {
00508 PRODUCT_INF[PRODUCT_ID_ADDRESS] =
00509 Rd_bitfield(Get_system_register(AVR32_CONFIG0), AVR32_CONFIG0_PROCESSORID_MASK);
00510 PRODUCT_INF[PRODUCT_REVISION_ADDRESS] =
00511 Rd_bitfield(Get_system_register(AVR32_CONFIG0), AVR32_CONFIG0_PROCESSORREVISION_MASK);
00512
00513 MEMORY_END_ADDRESS[MEM_FLASH].long_address = flashc_get_flash_size() - 1;
00514
00515 security_active = flashc_is_security_bit_active();
00516 }
00517
00518
00519 static void usb_dfu_stop(void)
00520 {
00521 force_isp(FALSE);
00522
00523 Usb_ack_control_out_received_free();
00524 Usb_ack_control_in_ready_send();
00525
00526 while (!Is_usb_setup_received());
00527 Usb_ack_setup_received_free();
00528 Usb_ack_control_in_ready_send();
00529
00530 while (!Is_usb_control_in_ready());
00531
00532 Disable_global_interrupt();
00533 Usb_disable();
00534 (void)Is_usb_enabled();
00535 Enable_global_interrupt();
00536 Usb_disable_otg_pad();
00537 }
00538
00539
00542 Bool usb_dfu_dnload(void)
00543 {
00544 static U8 tmp_memory;
00545 static U16 tmp_page;
00546
00547 if (!is_isp_forced()) force_isp(TRUE);
00548
00549 dfu_status = STATUS_OK;
00550
00551 Usb_read_endpoint_data(EP_CONTROL, 16);
00552 Usb_read_endpoint_data(EP_CONTROL, 16);
00553 length = Usb_read_endpoint_data(EP_CONTROL, 16);
00554 length = usb_format_usb_to_mcu_data(16, length);
00555 Usb_ack_setup_received_free();
00556
00557 if (length)
00558 {
00559 while (!Is_usb_control_out_received());
00560 Usb_reset_endpoint_fifo_access(EP_CONTROL);
00561
00562 cmd_group = Usb_read_endpoint_data(EP_CONTROL, 8);
00563 cmd = Usb_read_endpoint_data(EP_CONTROL, 8);
00564 switch (cmd_group)
00565 {
00566 case CMD_GRP_DNLOAD:
00567 if (security_active)
00568 {
00569 goto unsupported_request;
00570 }
00571 if (!get_and_check_mem_range()) break;
00572 if (!MEMORY_ACCESS[memory].write)
00573 {
00574 dfu_status = STATUS_errWRITE;
00575 break;
00576 }
00577 switch (cmd)
00578 {
00579 case CMD_PROGRAM_START:
00580 Usb_ack_control_out_received_free();
00581 write_mem();
00582 break;
00583
00584 default:
00585 goto unsupported_request;
00586 }
00587 break;
00588
00589 case CMD_GRP_UPLOAD:
00590 if (security_active)
00591 {
00592 goto unsupported_request;
00593 }
00594 if (!get_and_check_mem_range()) break;
00595 if (!MEMORY_ACCESS[memory].read)
00596 {
00597 dfu_status = STATUS_errVERIFY;
00598 break;
00599 }
00600 switch (cmd)
00601 {
00602 case CMD_READ_MEMORY:
00603 break;
00604
00605 case CMD_BLANK_CHECK:
00606 erase_check_mem();
00607 break;
00608
00609 default:
00610 goto unsupported_request;
00611 }
00612 break;
00613
00614 case CMD_GRP_EXEC:
00615 switch (cmd)
00616 {
00617 case CMD_ERASE:
00618 switch (Usb_read_endpoint_data(EP_CONTROL, 8))
00619 {
00620 case CMD_ERASE_ARG_CHIP:
00621 memory = MEM_FLASH;
00622 end_address.long_address = start_address.long_address = 0;
00623 flashc_lock_all_regions(FALSE);
00624 flashc_erase_all_pages(FALSE);
00625 security_active = FALSE;
00626 break;
00627
00628 default:
00629 goto unsupported_request;
00630 }
00631 break;
00632
00633 case CMD_START_APPLI:
00634 switch (Usb_read_endpoint_data(EP_CONTROL, 8))
00635 {
00636 case CMD_START_APPLI_ARG_RESET:
00637 usb_dfu_stop();
00638 Disable_global_interrupt();
00639 AVR32_WDT.ctrl = AVR32_WDT_CTRL_EN_MASK |
00640 (10 << AVR32_WDT_CTRL_PSEL_OFFSET) |
00641 (AVR32_WDT_KEY_VALUE << AVR32_WDT_CTRL_KEY_OFFSET);
00642 AVR32_WDT.ctrl = AVR32_WDT_CTRL_EN_MASK |
00643 (10 << AVR32_WDT_CTRL_PSEL_OFFSET) |
00644 ((~AVR32_WDT_KEY_VALUE << AVR32_WDT_CTRL_KEY_OFFSET) & AVR32_WDT_CTRL_KEY_MASK);
00645 while (1);
00646
00647 case CMD_START_APPLI_ARG_NO_RESET:
00648 usb_dfu_stop();
00649 sys_clk_gen_stop();
00650 wait_10_ms();
00651 boot_program();
00652 break;
00653
00654 default:
00655 goto unsupported_request;
00656 }
00657 break;
00658
00659 default:
00660 goto unsupported_request;
00661 }
00662 break;
00663
00664 case CMD_GRP_SELECT:
00665 if (security_active)
00666 {
00667 goto unsupported_request;
00668 }
00669 switch (cmd)
00670 {
00671 case CMD_SELECT_MEMORY:
00672 switch (Usb_read_endpoint_data(EP_CONTROL, 8))
00673 {
00674 case CMD_SELECT_MEMORY_ARG_UNIT:
00675 switch (tmp_memory = Usb_read_endpoint_data(EP_CONTROL, 8))
00676 {
00677 case MEM_FLASH:
00678 case MEM_EEPROM:
00679 case MEM_SECURITY:
00680 case MEM_CONFIGURATION:
00681 case MEM_BOOTLOADER:
00682 case MEM_SIGNATURE:
00683 case MEM_USER:
00684 memory = tmp_memory;
00685 end_address.long_address = start_address.long_address = 0;
00686 break;
00687
00688 default:
00689 dfu_status = STATUS_errADDRESS;
00690 }
00691 break;
00692
00693 case CMD_SELECT_MEMORY_ARG_PAGE:
00694 MSB(tmp_page) = Usb_read_endpoint_data(EP_CONTROL, 8);
00695 LSB(tmp_page) = Usb_read_endpoint_data(EP_CONTROL, 8);
00696 if (tmp_page <= MEMORY_END_ADDRESS[memory].page)
00697 {
00698 end_address.page = start_address.page = tmp_page;
00699 }
00700 else dfu_status = STATUS_errADDRESS;
00701 break;
00702
00703 default:
00704 goto unsupported_request;
00705 }
00706 break;
00707
00708 default:
00709 goto unsupported_request;
00710 }
00711 break;
00712
00713 default:
00714 unsupported_request:
00715 dfu_status = STATUS_errSTALLEDPKT;
00716 }
00717
00718 Usb_ack_control_out_received_free();
00719 }
00720
00721 usb_dfu_status = dfu_status;
00722 if (usb_dfu_status != STATUS_OK &&
00723 usb_dfu_status != STATUS_errCHECK_ERASED) return FALSE;
00724
00725 Usb_ack_control_in_ready_send();
00726 while (!Is_usb_control_in_ready());
00727 return TRUE;
00728 }
00729
00730
00733 Bool usb_dfu_upload(void)
00734 {
00735 Usb_ack_setup_received_free();
00736 Usb_reset_endpoint_fifo_access(EP_CONTROL);
00737
00738 if (cmd_group == CMD_GRP_UPLOAD &&
00739 (dfu_status == STATUS_OK ||
00740 dfu_status == STATUS_errCHECK_ERASED))
00741 {
00742 switch (cmd)
00743 {
00744 case CMD_READ_MEMORY:
00745 read_mem();
00746 break;
00747
00748 case CMD_BLANK_CHECK:
00749 Usb_write_endpoint_data(EP_CONTROL, 16, dfu_format_mcu_to_dfu_data(16, start_address.page_offset));
00750 break;
00751
00752 default:
00753 goto unsupported_request;
00754 }
00755 }
00756 else
00757 {
00758 unsupported_request:
00759 dfu_status = STATUS_errSTALLEDPKT;
00760 }
00761
00762 usb_dfu_status = dfu_status;
00763 if (usb_dfu_status != STATUS_OK &&
00764 usb_dfu_status != STATUS_errCHECK_ERASED) return FALSE;
00765
00766 if (Usb_byte_count(EP_CONTROL)) Usb_ack_control_in_ready_send();
00767 while (!Is_usb_control_out_received());
00768 Usb_ack_control_out_received_free();
00769 return TRUE;
00770 }
00771
00772
00773 #endif // USB_DEVICE_FEATURE == ENABLED