utils/jz4740_tools/jz4740_usbtool.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * Copyright (C) 2008 by Maurus Cuelenaere
  11  *
  12  * based on tcctool.c by Dave Chapman
  13  *
  14  * USB code based on ifp-line - http://ifp-driver.sourceforge.net
  15  *
  16  * ifp-line is (C) Pavel Kriz, Jun Yamishiro and Joe Roback and
  17  * licensed under the GPL (v2)
  18  *
  19  *
  20  * This program is free software; you can redistribute it and/or
  21  * modify it under the terms of the GNU General Public License
  22  * as published by the Free Software Foundation; either version 2
  23  * of the License, or (at your option) any later version.
  24  *
  25  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  26  * KIND, either express or implied.
  27  *
  28  ****************************************************************************/
  29
  30 #include <stdio.h>
  31 #include <inttypes.h>
  32 #include <usb.h>
  33 #include <string.h>
  34 #include <sys/types.h>
  35 #include <sys/stat.h>
  36 #include <unistd.h>
  37 #include <fcntl.h>
  38 #include <stdbool.h>
  39 #include <unistd.h>
  40 #include "jz4740.h"
  41 #include "jz_xloader.h"
  42
  43 #define VERSION "0.4"
  44
  45 #define MAX_FIRMWARESIZE   (64*1024*1024)   /* Arbitrary limit (for safety) */
  46
  47 /* For win32 compatibility: */
  48 #ifndef O_BINARY
  49 #define O_BINARY 0
  50 #endif
  51
  52 /* USB IDs for USB Boot Mode */
  53 #define VID              0x601A
  54 #define PID              0x4740
  55
  56 #define EP_BULK_TO       0x01
  57 #define TOUT             5000
  58
  59 enum USB_JZ4740_REQUEST
  60 {
  61     VR_GET_CPU_INFO = 0,
  62     VR_SET_DATA_ADDRESS,
  63     VR_SET_DATA_LENGTH,
  64     VR_FLUSH_CACHES,
  65     VR_PROGRAM_START1,
  66     VR_PROGRAM_START2,
  67     VR_NOR_OPS,
  68     VR_NAND_OPS,
  69     VR_SDRAM_OPS,
  70     VR_CONFIGURATION
  71 };
  72
  73 enum NOR_OPS_TYPE
  74 {
  75     NOR_INIT = 0,
  76     NOR_QUERY,
  77     NOR_WRITE,
  78     NOR_ERASE_CHIP,
  79     NOR_ERASE_SECTOR
  80 };
  81
  82 enum NOR_FLASH_TYPE
  83 {
  84     NOR_AM29 = 0,
  85     NOR_SST28,
  86     NOR_SST39x16,
  87     NOR_SST39x8
  88 };
  89
  90 enum NAND_OPS_TYPE
  91 {
  92     NAND_QUERY = 0,
  93     NAND_INIT,
  94     NAND_MARK_BAD,
  95     NAND_READ_OOB,
  96     NAND_READ_RAW,
  97     NAND_ERASE,
  98     NAND_READ,
  99     NAND_PROGRAM,
 100     NAND_READ_TO_RAM
 101 };
 102
 103 enum SDRAM_OPS_TYPE
 104 {
 105     SDRAM_LOAD,
 106 };
 107
 108 enum DATA_STRUCTURE_OB
 109 {
 110     DS_flash_info,
 111     DS_hand
 112 };
 113
 114 enum OPTION
 115 {
 116     OOB_ECC,
 117     OOB_NO_ECC,
 118     NO_OOB,
 119 };
 120
 121 int filesize(FILE* fd)
 122 {
 123     int ret;
 124
 125     fseek(fd, 0, SEEK_END);
 126     ret = ftell(fd);
 127     fseek(fd, 0, SEEK_SET);
 128
 129     return ret;
 130 }
 131
 132 bool file_exists(const char* filename)
 133 {
 134     FILE* fp = fopen(filename, "r");
 135
 136     if(fp)
 137     {
 138         fclose(fp);
 139         return true;
 140     }
 141     else
 142         return false;
 143 }
 144
 145
 146 #define SEND_COMMAND(cmd, arg) err = usb_control_msg(dh, USB_ENDPOINT_OUT | USB_TYPE_VENDOR, (cmd), (arg)>>16, (arg)&0xFFFF, NULL, 0, TOUT);\
 147                                if (err < 0) \
 148                                { \
 149                                    fprintf(stderr,"\n[ERR]  Error sending control message (%d, %s)\n", err, usb_strerror()); \
 150                                    return -1; \
 151                                }
 152
 153 #define GET_CPU_INFO(s)        err = usb_control_msg(dh, USB_ENDPOINT_IN | USB_TYPE_VENDOR, VR_GET_CPU_INFO, 0, 0, (s), 8, TOUT); \
 154                                if (err < 0) \
 155                                { \
 156                                    fprintf(stderr,"\n[ERR]  Error sending control message (%d, %s)\n", err, usb_strerror()); \
 157                                    return -1; \
 158                                }
 159
 160 #define SEND_DATA(ptr, size)   err = usb_bulk_write(dh, USB_ENDPOINT_OUT | EP_BULK_TO, ((char*)(ptr)), (size), TOUT); \
 161                                if (err != (size))  \
 162                                { \
 163                                    fprintf(stderr,"\n[ERR]  Error writing data\n"); \
 164                                    fprintf(stderr,"[ERR]  Bulk write error (%d, %s)\n", err, strerror(-err)); \
 165                                    return -1; \
 166                                }
 167
 168 #define GET_DATA(ptr, size)    err = usb_bulk_read(dh, USB_ENDPOINT_IN | EP_BULK_TO, ((char*)(ptr)), (size), TOUT); \
 169                                if (err != (size))  \
 170                                { \
 171                                    fprintf(stderr,"\n[ERR]  Error writing data\n"); \
 172                                    fprintf(stderr,"[ERR]  Bulk write error (%d, %s)\n", err, strerror(-err)); \
 173                                    return -1; \
 174                                }
 175 int upload_data(usb_dev_handle* dh, int address, unsigned char* p, int len)
 176 {
 177     int err;
 178     char buf[9];
 179     unsigned char* tmp_buf;
 180
 181     fprintf(stderr, "[INFO] GET_CPU_INFO: ");
 182     GET_CPU_INFO(buf);
 183     buf[8] = 0;
 184     fprintf(stderr, "%s\n", buf);
 185
 186     fprintf(stderr, "[INFO] SET_DATA_ADDRESS to 0x%x...", address);
 187     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 188     fprintf(stderr, " Done!\n");
 189
 190     fprintf(stderr, "[INFO] Sending data...");
 191     /* Must not split the file in several packages! */
 192     SEND_DATA(p, len);
 193     fprintf(stderr, " Done!\n");
 194
 195     fprintf(stderr, "[INFO] Verifying data...");
 196     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 197     SEND_COMMAND(VR_SET_DATA_LENGTH, len);
 198     tmp_buf = malloc(len);
 199     if (tmp_buf == NULL)
 200     {
 201         fprintf(stderr, "\n[ERR]  Could not allocate memory.\n");
 202         return -1;
 203     }
 204     GET_DATA(tmp_buf, len);
 205     if (memcmp(tmp_buf, p, len) != 0)
 206         fprintf(stderr, "\n[WARN] Sent data isn't the same as received data...\n");
 207     else
 208         fprintf(stderr, " Done!\n");
 209     free(tmp_buf);
 210
 211     return 0;
 212 }
 213
 214 int boot(usb_dev_handle* dh, int address, bool stage2)
 215 {
 216     int err;
 217
 218     fprintf(stderr, "[INFO] Booting device STAGE%d...", (stage2 ? 2 : 1));
 219     SEND_COMMAND((stage2 ? VR_PROGRAM_START2 : VR_PROGRAM_START1), address );
 220     fprintf(stderr, " Done!\n");
 221
 222     return err;
 223 }
 224
 225 int upload_app(usb_dev_handle* dh, int address, unsigned char* p, int len, bool stage2)
 226 {
 227     int err = upload_data(dh, address, p, len);
 228     if(err == 0)
 229     {
 230         err = boot(dh, address, stage2);
 231         if(err == 0)
 232             fprintf(stderr, "[INFO] Done!\n");
 233     }
 234
 235     return err;
 236 }
 237
 238 int read_data(usb_dev_handle* dh, int address, unsigned char *p, int len)
 239 {
 240     int err;
 241     char buf[9];
 242
 243     fprintf(stderr, "[INFO] GET_CPU_INFO: ");
 244     GET_CPU_INFO(buf);
 245     buf[8] = 0;
 246     fprintf(stderr, "%s\n", buf);
 247
 248     fprintf(stderr, "[INFO] Reading data...");
 249     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 250     SEND_COMMAND(VR_SET_DATA_LENGTH, len);
 251     GET_DATA(p, len);
 252     fprintf(stderr, " Done!\n");
 253     return 0;
 254 }
 255
 256 unsigned int read_reg(usb_dev_handle* dh, int address, int size)
 257 {
 258     int err;
 259     unsigned char buf[4];
 260
 261     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 262     SEND_COMMAND(VR_SET_DATA_LENGTH, size);
 263     GET_DATA(buf, size);
 264
 265     if(size == 1)
 266         return buf[0];
 267     else if(size == 2)
 268         return (buf[1] << 8) | buf[0];
 269     else if(size == 4)
 270         return (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
 271     else
 272         return 0;
 273 }
 274
 275 int set_reg(usb_dev_handle* dh, int address, unsigned int val, int size)
 276 {
 277     int err, i;
 278     unsigned char buf[4];
 279
 280     buf[0] = val & 0xff;
 281     if(i > 1)
 282     {
 283         buf[1] = (val >> 8) & 0xff;
 284         if(i > 2)
 285         {
 286             buf[2] = (val >> 16) & 0xff;
 287             buf[3] = (val >> 24) & 0xff;
 288         }
 289     }
 290
 291     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 292     SEND_DATA(buf, size);
 293
 294     return 0;
 295 }
 296 #define or_reg(dh, adr, val, size) set_reg(dh, adr, (read_reg(dh, adr, size) | (val)), size);
 297 #define and_reg(dh, adr, val, size) set_reg(dh, adr, (read_reg(dh, adr, size) & (val)), size);
 298 #define bc_reg(dh, adr, val, size) set_reg(dh, adr, (read_reg(dh, adr, size) & ~(val)), size);
 299 #define xor_reg(dh, adr, val, size) set_reg(dh, adr, (read_reg(dh, adr, size) ^ (val)), size);
 300
 301 #define TEST(m, size) fprintf(stderr, "%s -> %x\n", #m, read_reg(dh, m, size));
 302 int test_device(usb_dev_handle* dh)
 303 {
 304     TEST(INTC_ISR, 4);
 305     TEST(INTC_IMR, 4);
 306     TEST(INTC_IMSR, 4);
 307     TEST(INTC_IMCR, 4);
 308     TEST(INTC_IPR, 4);
 309
 310     fprintf(stderr, "\n");
 311     TEST(RTC_RCR, 4);
 312     TEST(RTC_RSR, 4);
 313     TEST(RTC_RSAR, 4);
 314     TEST(RTC_RGR, 4);
 315     TEST(RTC_HCR, 4);
 316     TEST(RTC_RCR, 4);
 317     TEST(RTC_HWFCR, 4);
 318     TEST(RTC_HRCR, 4);
 319     TEST(RTC_HWCR, 4);
 320     TEST(RTC_HWSR, 4);
 321
 322     fprintf(stderr, "\n");
 323     TEST(GPIO_PXPIN(0), 4);
 324     TEST(GPIO_PXPIN(1), 4);
 325     TEST(GPIO_PXPIN(2), 4);
 326     TEST(GPIO_PXPIN(3), 4);
 327
 328     fprintf(stderr, "\n");
 329     TEST(CPM_CLKGR, 4);
 330
 331     fprintf(stderr, "\n");
 332     TEST(SADC_ENA, 1);
 333     TEST(SADC_CTRL, 1);
 334     TEST(SADC_TSDAT, 4);
 335     TEST(SADC_BATDAT, 2);
 336     TEST(SADC_STATE, 1);
 337
 338     fprintf(stderr, "\n");
 339
 340     TEST(SLCD_CFG, 4);
 341     TEST(SLCD_CTRL, 1);
 342     TEST(SLCD_STATE, 1);
 343
 344     return 0;
 345 }
 346
 347 unsigned int read_file(const char *name, unsigned char **buffer)
 348 {
 349     FILE *fd;
 350     int len, n;
 351
 352     fd = fopen(name, "rb");
 353     if (fd == NULL)
 354     {
 355         fprintf(stderr, "[ERR]  Could not open %s\n", name);
 356         return 0;
 357     }
 358
 359     len = filesize(fd);
 360
 361     *buffer = (unsigned char*)malloc(len);
 362     if (*buffer == NULL)
 363     {
 364         fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 365         fclose(fd);
 366         return 0;
 367     }
 368
 369     n = fread(*buffer, 1, len, fd);
 370     if (n != len)
 371     {
 372         fprintf(stderr, "[ERR]  Short read.\n");
 373         fclose(fd);
 374         return 0;
 375     }
 376     fclose(fd);
 377
 378     return len;
 379 }
 380 #define _GET_CPU fprintf(stderr, "[INFO] GET_CPU_INFO:"); \
 381                  GET_CPU_INFO(cpu); \
 382                  cpu[8] = 0; \
 383                  fprintf(stderr, " %s\n", cpu);
 384 #define _SET_ADDR(a) fprintf(stderr, "[INFO] Set address to 0x%x...", a); \
 385                      SEND_COMMAND(VR_SET_DATA_ADDRESS, a); \
 386                      fprintf(stderr, " Done!\n");
 387 #define _SEND_FILE(a) fsize = read_file(a, &buffer); \
 388                       if(fsize == 0) \
 389                         return -1; \
 390                       fprintf(stderr, "[INFO] Sending file %s: %d bytes...", a, fsize); \
 391                       SEND_DATA(buffer, fsize); \
 392                       free(buffer); \
 393                       fprintf(stderr, " Done!\n");
 394 #define _VERIFY_DATA(a,c) fprintf(stderr, "[INFO] Verifying data (%s)...", a); \
 395                           fsize = read_file(a, &buffer); \
 396                           if(fsize == 0) \
 397                             return -1; \
 398                           buffer2 = (unsigned char*)malloc(fsize); \
 399                           SEND_COMMAND(VR_SET_DATA_ADDRESS, c); \
 400                           SEND_COMMAND(VR_SET_DATA_LENGTH,  fsize); \
 401                           GET_DATA(buffer2, fsize); \
 402                           if(memcmp(buffer, buffer2, fsize) != 0) \
 403                               fprintf(stderr, "\n[WARN] Sent data isn't the same as received data...\n"); \
 404                           else \
 405                               fprintf(stderr, " Done!\n"); \
 406                           free(buffer); \
 407                           free(buffer2);
 408 #define _STAGE1(a)     fprintf(stderr, "[INFO] Stage 1 at 0x%x\n", a); \
 409                        SEND_COMMAND(VR_PROGRAM_START1, a);
 410 #define _STAGE2(a)     fprintf(stderr, "[INFO] Stage 2 at 0x%x\n", a); \
 411                        SEND_COMMAND(VR_PROGRAM_START2, a);
 412 #define _FLUSH         fprintf(stderr, "[INFO] Flushing caches...\n"); \
 413                        SEND_COMMAND(VR_FLUSH_CACHES, 0);
 414 #ifdef _WIN32
 415  #define _SLEEP(x) Sleep(x*1000);
 416 #else
 417  #define _SLEEP(x) sleep(x);
 418 #endif
 419 int mimic_of(usb_dev_handle *dh, bool vx767)
 420 {
 421     int err, fsize;
 422     unsigned char *buffer, *buffer2;
 423     char cpu[8];
 424
 425     fprintf(stderr, "[INFO] Start!\n");
 426     _GET_CPU;
 427     _SET_ADDR(0x8000 << 16);
 428     _SEND_FILE("1.bin");
 429     _GET_CPU;
 430     _VERIFY_DATA("1.bin", 0x8000 << 16);
 431     _STAGE1(0x8000 << 16);
 432     _SLEEP(3);
 433     _VERIFY_DATA("2.bin", 0xB3020060);
 434     _GET_CPU;
 435     _GET_CPU;
 436     _FLUSH;
 437     _GET_CPU;
 438     _GET_CPU;
 439     _SET_ADDR(0x8000 << 16);
 440     _SEND_FILE("3.bin");
 441     _GET_CPU;
 442     _VERIFY_DATA("3.bin", 0x8000 << 16);
 443     _GET_CPU;
 444     _FLUSH;
 445     _GET_CPU;
 446     _GET_CPU;
 447     _SET_ADDR(0x80D0 << 16);
 448     _SEND_FILE("4.bin");
 449     _GET_CPU;
 450     _VERIFY_DATA("4.bin", 0x80D0 << 16);
 451     _GET_CPU;
 452     _FLUSH;
 453     _GET_CPU;
 454     _GET_CPU;
 455     _SET_ADDR(0x80E0 << 16);
 456     _SEND_FILE("5.bin");
 457     _GET_CPU;
 458     _VERIFY_DATA("5.bin", 0x80E0 << 16);
 459     _GET_CPU;
 460     _FLUSH;
 461     _GET_CPU;
 462     _GET_CPU;
 463     _SET_ADDR(0x80004000);
 464     _SEND_FILE("6.bin");
 465     _GET_CPU;
 466     _VERIFY_DATA("6.bin", 0x80004000);
 467     _GET_CPU;
 468     _FLUSH;
 469     _GET_CPU;
 470     _GET_CPU;
 471     _SET_ADDR(0x80FD << 16);
 472     _SEND_FILE("7.bin");
 473     _GET_CPU;
 474     _VERIFY_DATA("7.bin", 0x80FD << 16);
 475     _GET_CPU;
 476     _FLUSH;
 477     _GET_CPU;
 478     _STAGE2(0x80FD0004);
 479     _VERIFY_DATA("8.bin", 0x80004004);
 480     _VERIFY_DATA("9.bin", 0x80004008);
 481     _SLEEP(2);
 482     _GET_CPU;
 483     _SET_ADDR(0x80E0 << 16);
 484     _SEND_FILE("10.bin");
 485     _GET_CPU;
 486     _VERIFY_DATA("10.bin", 0x80E0 << 16);
 487     _GET_CPU;
 488     _FLUSH;
 489     _GET_CPU;
 490     if(vx767)
 491     {
 492         _STAGE2(0x80E10008);
 493     }
 494     else
 495     {
 496         _STAGE2(0x80E00008);
 497     }
 498     fprintf(stderr, "[INFO] Done!\n");
 499     return 0;
 500 }
 501
 502 int send_rockbox(usb_dev_handle *dh, const char* filename)
 503 {
 504     int fsize;
 505     unsigned char *buffer;
 506
 507     fprintf(stderr, "[INFO] Start!\n");
 508     if(file_exists("jz_xloader.bin"))
 509     {
 510         fprintf(stderr, "[INFO] Using jz_xloader.bin\n");
 511         fsize = read_file("jz_xloader.bin", &buffer);
 512         upload_data(dh, 0x080000000, buffer, fsize);
 513         free(buffer);
 514     }
 515     else
 516     {
 517         fprintf(stderr, "[INFO] Using built-in jz_xloader.bin\n");
 518         upload_data(dh, 0x080000000, jz_xloader, LEN_jz_xloader);
 519     }
 520     boot(dh, 0x080000000, false);
 521     _SLEEP(1);
 522
 523     fsize = read_file(filename, &buffer);
 524     upload_data(dh, 0x080004000, buffer, fsize);
 525     free(buffer);
 526     boot(dh, 0x080004000, true);
 527
 528     fprintf(stderr, "[INFO] Done!\n");
 529
 530     return 0;
 531 }
 532
 533 #define SEND_NAND_COMMAND(cs, cmd, option) SEND_COMMAND(VR_NAND_OPS, ((cmd&0xF)|((cs&0xFF)<<4)|((option&0xFF)<<12)) );
 534 #define LENGTH 1024*1024*5
 535 int nand_dump(usb_dev_handle *dh)
 536 {
 537     int err;
 538     unsigned int n;
 539     FILE *fd;
 540     unsigned char* buffer;
 541
 542     fd = fopen("nand_dump.bin", "wb");
 543     if (fd == NULL)
 544     {
 545         fprintf(stderr, "[ERR]  Could not open nand_dump.bin\n");
 546         return 0;
 547     }
 548
 549     buffer = (unsigned char*)malloc(LENGTH);
 550     if (buffer == NULL)
 551     {
 552         fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 553         fclose(fd);
 554         return 0;
 555     }
 556
 557     SEND_NAND_COMMAND(0, NAND_INIT, 0);
 558     /*
 559     fprintf(stderr, "[INFO] Querying NAND...\n");
 560     SEND_NAND_COMMAND(0, NAND_QUERY, 0);
 561     GET_DATA(buffer, 4);
 562     printf("[INFO] %x %x %x %x\n", buffer[0], buffer[1], buffer[2], buffer[3]);
 563     */
 564     SEND_COMMAND(VR_SET_DATA_ADDRESS, 0);
 565     SEND_COMMAND(VR_SET_DATA_LENGTH, LENGTH);
 566     SEND_NAND_COMMAND(0, NAND_READ, NO_OOB);
 567
 568     fprintf(stderr, "[INFO] Reading data...\n");
 569     err = usb_bulk_read(dh, USB_ENDPOINT_IN | EP_BULK_TO, (char*)buffer, LENGTH, TOUT);
 570     if (err != LENGTH)
 571     {
 572         fprintf(stderr,"\n[ERR]  Error writing data\n");
 573         fprintf(stderr,"[ERR]  Bulk write error (%d, %s)\n", err, strerror(-err));
 574         fclose(fd);
 575         free(buffer);
 576         return -1;
 577     }
 578
 579     n = fwrite(buffer, 1, LENGTH, fd);
 580     if (n != LENGTH)
 581     {
 582         fprintf(stderr, "[ERR]  Short write.\n");
 583         fclose(fd);
 584         free(buffer);
 585         return 0;
 586     }
 587     fclose(fd);
 588     free(buffer);
 589
 590     return n;
 591 }
 592
 593 #define ROM_LENGTH 0x1000*16
 594 int rom_dump(usb_dev_handle *dh)
 595 {
 596     int err;
 597     unsigned int n;
 598     FILE *fd;
 599     unsigned char* buffer;
 600
 601     fd = fopen("rom_dump.bin", "wb");
 602     if (fd == NULL)
 603     {
 604         fprintf(stderr, "[ERR]  Could not open rom_dump.bin\n");
 605         return 0;
 606     }
 607
 608     buffer = (unsigned char*)malloc(ROM_LENGTH);
 609     if (buffer == NULL)
 610     {
 611         fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 612         fclose(fd);
 613         return 0;
 614     }
 615
 616     SEND_COMMAND(VR_SET_DATA_ADDRESS, 0x1FC00000);
 617     SEND_COMMAND(VR_SET_DATA_LENGTH, ROM_LENGTH);
 618
 619     fprintf(stderr, "[INFO] Reading data...\n");
 620     err = usb_bulk_read(dh, USB_ENDPOINT_IN | EP_BULK_TO, (char*)buffer, ROM_LENGTH, TOUT);
 621     if (err != ROM_LENGTH)
 622     {
 623         fprintf(stderr,"\n[ERR]  Error writing data\n");
 624         fprintf(stderr,"[ERR]  Bulk write error (%d, %s)\n", err, strerror(-err));
 625         fclose(fd);
 626         free(buffer);
 627         return -1;
 628     }
 629
 630     n = fwrite(buffer, 1, ROM_LENGTH, fd);
 631     if (n != ROM_LENGTH)
 632     {
 633         fprintf(stderr, "[ERR]  Short write.\n");
 634         fclose(fd);
 635         free(buffer);
 636         return 0;
 637     }
 638     fclose(fd);
 639     free(buffer);
 640
 641     return n;
 642 }
 643
 644 int jzconnect(int address, unsigned char* buf, int len, int func)
 645 {
 646     struct usb_bus *bus;
 647     struct usb_device *tmp_dev;
 648     struct usb_device *dev = NULL;
 649     usb_dev_handle *dh;
 650     int err;
 651
 652     fprintf(stderr,"[INFO] Searching for device...\n");
 653
 654     usb_init();
 655     if(usb_find_busses() < 0)
 656     {
 657         fprintf(stderr, "[ERR]  Could not find any USB busses.\n");
 658         return -2;
 659     }
 660
 661     if (usb_find_devices() < 0)
 662     {
 663         fprintf(stderr, "[ERR]  USB devices not found(nor hubs!).\n");
 664         return -3;
 665     }
 666
 667     for (bus = usb_get_busses(); bus; bus = bus->next)
 668     {
 669         for (tmp_dev = bus->devices; tmp_dev; tmp_dev = tmp_dev->next)
 670         {
 671             if (tmp_dev->descriptor.idVendor == VID &&
 672                 tmp_dev->descriptor.idProduct == PID)
 673             {
 674                 dev = tmp_dev;
 675                 goto found;
 676             }
 677         }
 678     }
 679
 680     fprintf(stderr, "[ERR]  Device not found.\n");
 681     fprintf(stderr, "[ERR]  Ensure your device is in USB boot mode and run usbtool again.\n");
 682     return -4;
 683
 684 found:
 685     if ( (dh = usb_open(dev)) == NULL)
 686     {
 687         fprintf(stderr,"[ERR]  Unable to open device.\n");
 688         return -5;
 689     }
 690
 691 /* usb_set_configuration() calls are already done in Linux */
 692 #ifdef _WIN32
 693     err = usb_set_configuration(dh, 1);
 694
 695     if (err < 0)
 696     {
 697         fprintf(stderr, "[ERR]  usb_set_configuration failed (%d, %s)\n", err, usb_strerror());
 698         usb_close(dh);
 699         return -6;
 700     }
 701 #endif
 702
 703     /* "must be called" written in the libusb documentation */
 704     err = usb_claim_interface(dh, 0);
 705     if (err < 0)
 706     {
 707         fprintf(stderr, "[ERR]  Unable to claim interface (%d, %s)\n", err, usb_strerror());
 708         usb_close(dh);
 709         return -7;
 710     }
 711
 712     fprintf(stderr,"[INFO] Found device, uploading application.\n");
 713
 714     /* Now we can transfer the application to the device. */
 715
 716     switch(func)
 717     {
 718         case 1:
 719         case 5:
 720             err = upload_app(dh, address, buf, len, (func == 5));
 721         break;
 722         case 2:
 723             err = read_data(dh, address, buf, len);
 724         break;
 725         case 3:
 726             err = test_device(dh);
 727         break;
 728         case 6:
 729         case 7:
 730             err = mimic_of(dh, (func == 7));
 731         break;
 732         case 8:
 733             err = nand_dump(dh);
 734         break;
 735         case 9:
 736             err = rom_dump(dh);
 737         break;
 738         case 10:
 739             err = send_rockbox(dh, (char*)buf);
 740         break;
 741     }
 742
 743     /* release claimed interface */
 744     usb_release_interface(dh, 0);
 745
 746     usb_close(dh);
 747
 748     return err;
 749 }
 750
 751 void print_usage(void)
 752 {
 753 #ifdef _WIN32
 754     fprintf(stderr, "Usage: usbtool.exe <CMD> [FILE] [ADDRESS] [LEN]\n");
 755 #else
 756     fprintf(stderr, "Usage: usbtool <CMD> [FILE] [ADDRESS] [LEN]\n");
 757 #endif
 758
 759     fprintf(stderr, "\t[ADDRESS] has to be in 0xHEXADECIMAL format\n");
 760     fprintf(stderr, "\tCMD:\n");
 761     fprintf(stderr, "\t\t 1 -> upload file to specified address and boot from it\n");
 762     fprintf(stderr, "\t\t 2 -> read data from [ADDRESS] with length [LEN] to [FILE]\n");
 763     fprintf(stderr, "\t\t 3 -> read device status\n");
 764     fprintf(stderr, "\t\t 5 -> same as 1 but do a stage 2 boot\n");
 765     fprintf(stderr, "\t\t 6 -> mimic VX747 OF fw recovery\n");
 766     fprintf(stderr, "\t\t 7 -> mimic VX767 OF fw recovery\n");
 767     fprintf(stderr, "\t\t 8 -> do a NAND dump\n");
 768     fprintf(stderr, "\t\t 9 -> do a ROM dump\n");
 769     fprintf(stderr, "\t\t10 -> send Rockbox bootloader at [FILE] to SDRAM\n");
 770
 771 #ifdef _WIN32
 772     fprintf(stderr, "\nExample:\n\t usbtool.exe 1 fw.bin 0x80000000\n");
 773     fprintf(stderr, "\t usbtool.exe 2 save.bin 0x81000000 1024\n");
 774 #else
 775     fprintf(stderr, "\nExample:\n\t usbtool 1 fw.bin 0x80000000\n");
 776     fprintf(stderr, "\t usbtool 2 save.bin 0x81000000 1024\n");
 777 #endif
 778 }
 779
 780 int main(int argc, char* argv[])
 781 {
 782     unsigned char* buf;
 783     int n, len, address, cmd=0;
 784     FILE* fd;
 785
 786     fprintf(stderr, "USBtool v" VERSION " - (C) 2008 Maurus Cuelenaere\n");
 787     fprintf(stderr, "This is free software; see the source for copying conditions.  There is NO\n");
 788     fprintf(stderr, "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\n");
 789
 790     if(argc > 1)
 791         sscanf(argv[1], "%d", &cmd);
 792     switch(cmd)
 793     {
 794         case 5:
 795         case 1:
 796             if (strcmp(argv[3], "-1") == 0)
 797                 address = 0x80000000;
 798             else
 799             {
 800                 if (sscanf(argv[3], "0x%x", &address) <= 0)
 801                 {
 802                     print_usage();
 803                     return -1;
 804                 }
 805             }
 806
 807             fd = fopen(argv[2], "rb");
 808             if (fd < 0)
 809             {
 810                 fprintf(stderr, "[ERR]  Could not open %s\n", argv[2]);
 811                 return 4;
 812             }
 813
 814             len = filesize(fd);
 815
 816             if (len > MAX_FIRMWARESIZE)
 817             {
 818                 fprintf(stderr, "[ERR]  Firmware file too big\n");
 819                 fclose(fd);
 820                 return 5;
 821             }
 822
 823             buf = malloc(len);
 824             if (buf == NULL)
 825             {
 826                 fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 827                 fclose(fd);
 828                 return 6;
 829             }
 830
 831             n = fread(buf, 1, len, fd);
 832             if (n != len)
 833             {
 834                 fprintf(stderr, "[ERR]  Short read.\n");
 835                 fclose(fd);
 836                 return 7;
 837             }
 838             fclose(fd);
 839
 840             fprintf(stderr, "[INFO] File size: %d bytes\n", n);
 841
 842             return jzconnect(address, buf, len, cmd);
 843         case 2:
 844             if (sscanf(argv[3], "0x%x", &address) <= 0)
 845             {
 846                 print_usage();
 847                 return -1;
 848             }
 849
 850             fd = fopen(argv[2], "wb");
 851             if (fd < 0)
 852             {
 853                 fprintf(stderr, "[ERR]  Could not open %s\n", argv[2]);
 854                 return 4;
 855             }
 856
 857             sscanf(argv[4], "%d", &len);
 858
 859             buf = malloc(len);
 860             if (buf == NULL)
 861             {
 862                 fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 863                 fclose(fd);
 864                 return 6;
 865             }
 866
 867             int err = jzconnect(address, buf, len, 2);
 868
 869             n = fwrite(buf, 1, len, fd);
 870             if (n != len)
 871             {
 872                 fprintf(stderr, "[ERR]  Short write.\n");
 873                 fclose(fd);
 874                 return 7;
 875             }
 876             fclose(fd);
 877
 878             return err;
 879         case 10:
 880             if(argc < 3)
 881             {
 882                 print_usage();
 883                 return 1;
 884             }
 885
 886             if(!file_exists(argv[2]))
 887             {
 888                 print_usage();
 889                 return 1;
 890             }
 891             return jzconnect(address, (unsigned char*)argv[2], 0, 10);
 892         case 3:
 893         case 6:
 894         case 7:
 895         case 8:
 896         case 9:
 897             return jzconnect(address, NULL, 0, cmd);
 898         default:
 899             print_usage();
 900             return 1;
 901     }
 902
 903     return 0;
 904 }