Dumping of SPI Flash ROMs works, at least for Winbond.
[goodfet] / client / GoodFET.py
1 #!/usr/bin/env python
2 # GoodFET Client Library
3
4 # (C) 2009 Travis Goodspeed <travis at radiantmachines.com>
5 #
6 # This code is ugly as sin, for bootstrapping the firmware only.
7 # Rewrite cleanly as soon as is convenient.
8
9 import sys, time, string, cStringIO, struct
10 #sys.path.append("/usr/lib/tinyos")
11 import serial
12
13
14 class GoodFET:
15     def __init__(self, *args, **kargs):
16         self.data=[0];
17     def timeout(self):
18         print "timout\n";
19     def serInit(self, port):
20         """Open the serial port"""
21         self.serialport = serial.Serial(
22             port,
23             #9600,
24             115200,
25             parity = serial.PARITY_NONE
26             )
27         #Drop DTR, which is !RST, low to begin the app.
28         self.serialport.setDTR(0);
29         self.serialport.flushInput()
30         self.serialport.flushOutput()
31         
32         #Read and handle the initial command.
33         #time.sleep(1);
34         self.readcmd(); #Read the first command.
35         if(self.verb!=0x7F):
36             print "Verb is wrong.  Incorrect firmware?";
37         
38     def writecmd(self, app, verb, count, data):
39         """Write a command and some data to the GoodFET."""
40         self.serialport.write(chr(app));
41         self.serialport.write(chr(verb));
42         self.serialport.write(chr(count));
43         #print "count=%02x, len(data)=%04x" % (count,len(data));
44         if count!=0:
45             for d in data:
46                 self.serialport.write(chr(d));
47         self.readcmd();  #Uncomment this later, to ensure a response.
48     def readcmd(self):
49         """Read a reply from the GoodFET."""
50         self.app=ord(self.serialport.read(1));
51         self.verb=ord(self.serialport.read(1));
52         self.count=ord(self.serialport.read(1));
53         if self.count>0:
54             self.data=self.serialport.read(self.count);
55         #print "READ %02x %02x %02x " % (self.app, self.verb, self.count);
56         
57     #Monitor stuff
58     def peekbyte(self,address):
59         """Read a byte of memory from the monitor."""
60         self.data=[address&0xff,address>>8];
61         self.writecmd(0,0x02,2,self.data);
62         #self.readcmd();
63         return ord(self.data[0]);
64     def peekword(self,address):
65         """Read a word of memory from the monitor."""
66         return self.peekbyte(address)+(self.peekbyte(address+1)<<8);
67     def pokebyte(self,address,value):
68         """Set a byte of memory by the monitor."""
69         self.data=[address&0xff,address>>8,value];
70         self.writecmd(0,0x03,3,self.data);
71         return ord(self.data[0]);
72     def setBaud(self,baud):
73         rates=[9600, 9600, 19200, 38400];
74         self.data=[baud];
75         print "Changing FET baud."
76         self.serialport.write(chr(0x00));
77         self.serialport.write(chr(0x80));
78         self.serialport.write(chr(1));
79         self.serialport.write(chr(baud));
80         
81         print "Changed host baud."
82         self.serialport.setBaudrate(rates[baud]);
83         time.sleep(1);
84         self.serialport.flushInput()
85         self.serialport.flushOutput()
86         
87         print "Baud is now %i." % rates[baud];
88         return;
89     def monitortest(self):
90         """Self-test several functions through the monitor."""
91         print "Performing monitor self-test.";
92         
93         if self.peekword(0x0c00)!=0x0c04:
94             print "ERROR Fetched wrong value from 0x0c04.";
95         self.pokebyte(0x0021,0); #Drop LED
96         if self.peekbyte(0x0021)!=0:
97             print "ERROR, P1OUT not cleared.";
98         self.pokebyte(0x0021,1); #Light LED
99         
100         print "Self-test complete.";
101     
102     def SPIsetup(self):
103         """Moved the FET into the SPI application."""
104         self.writecmd(0x01,0x10,0,self.data); #SPI/SETUP
105         #self.readcmd();
106     def SPItrans8(self,byte):
107         """Read and write 8 bits by SPI."""
108         data=self.SPItrans([byte]);
109         return ord(data[0]);
110     
111     def SPItrans(self,data):
112         """Exchange data by SPI."""
113         self.data=data;
114         self.writecmd(0x01,0x00,len(data),data);
115         return self.data;
116     
117     JEDECmanufacturers={0xFF: "MISSING",
118                         0xEF: "Winbond"};
119     JEDECdevices={0xEF3014: "W25X80L",
120                   0xEF3013: "W25X40L",
121                   0xEF3012: "W25X20L",
122                   0xEF3011: "W25X10L"};
123     def SPIjedec(self):
124         """Grab an SPI Flash ROM's JEDEC bytes."""
125         data=[0x9f, 0, 0, 0];
126         data=self.SPItrans(data);
127         #print "Manufacturer: %02x\nType: %02x\nCapacity: %02x" % (ord(data[1]),ord(data[2]),ord(data[3]));
128         self.JEDECmanufacturer=ord(data[1]);
129         self.JEDECtype=ord(data[2]);
130         self.JEDECcapacity=ord(data[3]);
131         self.JEDECdevice=(ord(data[1])<<16)+(ord(data[2])<<8)+ord(data[3]);
132         return data;
133     def SPIpeek(self,adr):
134         """Grab a byte from an SPI Flash ROM."""
135         data=[0x03,
136               (adr&0xFF0000)>>16,
137               (adr&0xFF00)>>8,
138               adr&0xFF,
139               0];
140         self.SPItrans(data);
141         return ord(self.data[4]);
142     
143     def SPIjedecmanstr(self):
144         """Grab the JEDEC manufacturer string.  Call after SPIjedec()."""
145         man=self.JEDECmanufacturers[self.JEDECmanufacturer];
146         if man==0:
147             man="UNKNOWN";
148         return man;
149     
150     def SPIjedecstr(self):
151         """Grab the JEDEC manufacturer string.  Call after SPIjedec()."""
152         man=self.JEDECmanufacturers[self.JEDECmanufacturer];
153         if man==0:
154             man="UNKNOWN";
155         device=self.JEDECdevices[self.JEDECdevice];
156         if device==0:
157             device="???"
158         return "%s %s" % (man,device);
159     def MSP430setup(self):
160         """Move the FET into the MSP430 JTAG application."""
161         print "Initializing MSP430.";
162         self.writecmd(0x11,0x10,0,self.data);
163
164     
165     
166     def CCsetup(self):
167         """Move the FET into the CC2430/CC2530 application."""
168         print "Initializing Chipcon.";
169         self.writecmd(0x30,0x10,0,self.data);
170     def CCrd_config(self):
171         """Read the config register of a Chipcon."""
172         self.writecmd(0x30,0x82,0,self.data);
173         return ord(self.data[0]);
174     def CCwr_config(self,config):
175         """Write the config register of a Chipcon."""
176         self.writecmd(0x30,0x81,1,[config&0xFF]);
177     
178     CCversions={0x0100:"CC1110",
179                 0x8500:"CC2430",
180                 0x8900:"CC2431",
181                 0x8100:"CC2510",
182                 0x9100:"CC2511",
183                 0xFF00:"CCmissing"};
184     def CCidentstr(self):
185         ident=self.CCident();
186         chip=self.CCversions[ident&0xFF00];
187         return "%s/r%02x" % (chip, ident&0xFF); 
188     def CCident(self):
189         """Get a chipcon's ID."""
190         self.writecmd(0x30,0x8B,0,None);
191         chip=ord(self.data[0]);
192         rev=ord(self.data[1]);
193         return (chip<<8)+rev;
194     def CCgetPC(self):
195         """Get a chipcon's PC."""
196         self.writecmd(0x30,0x83,0,None);
197         hi=ord(self.data[0]);
198         lo=ord(self.data[1]);
199         return (hi<<8)+lo;
200     def CCdebuginstr(self,instr):
201         self.writecmd(0x30,0x88,len(instr),instr);
202         return ord(self.data[0]);
203     def MSP430peek(self,adr):
204         """Read the contents of memory at an address."""
205         self.data=[adr&0xff, (adr&0xff00)>>8];
206         self.writecmd(0x11,0x02,2,self.data);
207         return ord(self.data[0])+(ord(self.data[1])<<8);
208     def CCpeekcodebyte(self,adr):
209         """Read the contents of code memory at an address."""
210         self.data=[adr&0xff, (adr&0xff00)>>8];
211         self.writecmd(0x30,0x90,2,self.data);
212         return ord(self.data[0]);
213     def CCpeekdatabyte(self,adr):
214         """Read the contents of data memory at an address."""
215         self.data=[adr&0xff, (adr&0xff00)>>8];
216         self.writecmd(0x30,0x91, 2, self.data);
217         return ord(self.data[0]);
218     def CCpokedatabyte(self,adr,val):
219         """Write a byte to data memory."""
220         self.data=[adr&0xff, (adr&0xff00)>>8, val];
221         self.writecmd(0x30, 0x92, 3, self.data);
222         return ord(self.data[0]);
223     def CCchiperase(self):
224         """Erase all of the target's memory."""
225         self.writecmd(0x30,0x80,0,None);
226     def CCstatus(self):
227         """Check the status."""
228         self.writecmd(0x30,0x84,0,None);
229         return ord(self.data[0])
230     CCstatusbits={0x80 : "erased",
231                   0x40 : "pcon_idle",
232                   0x20 : "halted",
233                   0x10 : "pm0",
234                   0x08 : "halted",
235                   0x04 : "locked",
236                   0x02 : "oscstable",
237                   0x01 : "overflow"};
238     def CCstatusstr(self):
239         """Check the status as a string."""
240         status=self.CCstatus();
241         str="";
242         i=1;
243         while i<0x100:
244             if(status&i):
245                 str="%s %s" %(self.CCstatusbits[i],str);
246             i*=2;
247         return str;
248     def MSP430poke(self,adr,val):
249         """Read the contents of memory at an address."""
250         self.data=[adr&0xff, (adr&0xff00)>>8, val&0xff, (val&0xff00)>>8];
251         self.writecmd(0x11,0x03,4,self.data);
252         return;# ord(self.data[0])+(ord(self.data[1])<<8);
253     def MSP430start(self):
254         """Start debugging."""
255         self.writecmd(0x11,0x20,0,self.data);
256         ident=self.MSP430ident();
257         print "Target identifies as %04x." % ident;
258     
259     def CCstart(self):
260         """Start debugging."""
261         self.writecmd(0x30,0x20,0,self.data);
262         ident=self.CCidentstr();
263         print "Target identifies as %s." % ident;
264         print "Status: %s." % self.CCstatusstr();
265         self.CCreleasecpu();
266         self.CChaltcpu();
267         print "Status: %s." % self.CCstatusstr();
268     def CCstop(self):
269         """Stop debugging."""
270         self.writecmd(0x30,0x21,0,self.data);
271     def CCstep_instr(self):
272         """Step one instruction."""
273         self.writecmd(0x30,0x89,0,self.data);
274     def MSP430stop(self):
275         """Stop debugging."""
276         self.writecmd(0x11,0x21,0,self.data);
277     def MSP430haltcpu(self):
278         """Halt the CPU."""
279         self.writecmd(0x11,0xA0,0,self.data);
280     def MSP430releasecpu(self):
281         """Resume the CPU."""
282         self.writecmd(0x11,0xA1,0,self.data);
283     def CChaltcpu(self):
284         """Halt the CPU."""
285         self.writecmd(0x30,0x86,0,self.data);
286     def CCreleasecpu(self):
287         """Resume the CPU."""
288         self.writecmd(0x30,0x87,0,self.data);
289     def MSP430shiftir8(self,ins):
290         """Shift the 8-bit Instruction Register."""
291         data=[ins];
292         self.writecmd(0x11,0x80,1,data);
293         return ord(self.data[0]);
294     def MSP430shiftdr16(self,dat):
295         """Shift the 16-bit Data Register."""
296         data=[dat&0xFF,(dat&0xFF00)>>8];
297         self.writecmd(0x11,0x81,2,data);
298         return ord(self.data[0])#+(ord(self.data[1])<<8);
299     def MSP430setinstrfetch(self):
300         """Set the instruction fetch mode."""
301         self.writecmd(0x11,0xC1,0,self.data);
302         return self.data[0];
303     def MSP430ident(self):
304         """Grab self-identification word from 0x0FF0 as big endian."""
305         i=self.MSP430peek(0x0ff0);
306         return ((i&0xFF00)>>8)+((i&0xFF)<<8)
307     def MSP430test(self):
308         """Test MSP430 JTAG.  Requires that a chip be attached."""
309         if self.MSP430ident()==0xffff:
310             print "Is anything connected?";
311         print "Testing RAM.";
312         temp=self.MSP430peek(0x0200);
313         self.MSP430poke(0x0200,0xdead);
314         if(self.MSP430peek(0x0200)!=0xdead):
315             print "Poke of 0x0200 did not set to 0xDEAD properly.";
316             return;
317         self.MSP430poke(0x0200,temp); #restore old value.
318     def MSP430flashtest(self):
319         self.MSP430masserase();
320         i=0x2500;
321         while(i<0xFFFF):
322             if(self.MSP430peek(i)!=0xFFFF):
323                 print "ERROR: Unerased flash at %04x."%i;
324             self.MSP430writeflash(i,0xDEAD);
325             i+=2;
326     def MSP430masserase(self):
327         """Erase MSP430 flash memory."""
328         self.writecmd(0x11,0xE3,0,None);
329     def MSP430writeflash(self,adr,val):
330         """Write a word of flash memory."""
331         if(self.MSP430peek(adr)!=0xFFFF):
332             print "FLASH ERROR: %04x not clear." % adr;
333         data=[adr&0xFF,(adr&0xFF00)>>8,val&0xFF,(val&0xFF00)>>8];
334         self.writecmd(0x11,0xE1,4,data);
335         rval=ord(self.data[0])+(ord(self.data[1])<<8);
336         if(val!=rval):
337             print "FLASH WRITE ERROR AT %04x.  Found %04x, wrote %04x." % (adr,rval,val);
338             
339     def MSP430dumpbsl(self):
340         self.MSP430dumpmem(0xC00,0xfff);
341     def MSP430dumpallmem(self):
342         self.MSP430dumpmem(0x200,0xffff);
343     def MSP430dumpmem(self,begin,end):
344         i=begin;
345         while i<end:
346             print "%04x %04x" % (i, self.MSP430peek(i));
347             i+=2;
348     def CCtest(self):
349         self.CCreleasecpu();
350         self.CChaltcpu();
351         print "Status: %s" % self.CCstatusstr();
352         
353         #Grab ident three times, should be equal.
354         ident1=self.CCident();
355         ident2=self.CCident();
356         ident3=self.CCident();
357         if(ident1!=ident2 or ident2!=ident3):
358             print "Error, repeated ident attempts unequal."
359             print "%04x, %04x, %04x" % (ident1, ident2, ident3);
360         
361         #Single step, printing PC.
362         #print "Tracing execution at startup."
363         for i in range(1,15):
364             pc=self.CCgetPC();
365             byte=self.CCpeekcodebyte(i);
366             print "PC=%04x, %02x" % (pc, byte);
367             self.CCstep_instr();
368         
369         #print "Verifying that debugging a NOP doesn't affect the PC."
370         for i in range(1,15):
371             pc=self.CCgetPC();
372             self.CCdebuginstr([0x00]);
373             if(pc!=self.CCgetPC()):
374                 print "ERROR: PC changed during CCdebuginstr([NOP])!";
375         for i in range(0xE500,0xE600):
376             byte=self.CCpeekdatabyte(i);
377             print "data %04x: %02x" % (i,byte);
378             self.CCpokedatabyte(i,i&0xFF);
379             byte=self.CCpeekdatabyte(i);
380             print "data %04x: %02x" % (i,byte);
381         print "Status: %s." % self.CCstatusstr();
382         #Exit debugger
383         self.CCstop();
384         print "Done.";