utils/jz4740_tools/jz4740_usbtool.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * Copyright (C) 2008 by Maurus Cuelenaere
  11  *
  12  * based on tcctool.c by Dave Chapman
  13  *
  14  * USB code based on ifp-line - http://ifp-driver.sourceforge.net
  15  *
  16  * ifp-line is (C) Pavel Kriz, Jun Yamishiro and Joe Roback and
  17  * licensed under the GPL (v2)
  18  *
  19  *
  20  * This program is free software; you can redistribute it and/or
  21  * modify it under the terms of the GNU General Public License
  22  * as published by the Free Software Foundation; either version 2
  23  * of the License, or (at your option) any later version.
  24  *
  25  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  26  * KIND, either express or implied.
  27  *
  28  ****************************************************************************/
  29
  30 #include <stdio.h>
  31 #include <inttypes.h>
  32 #include <usb.h>
  33 #include <string.h>
  34 #include <sys/types.h>
  35 #include <sys/stat.h>
  36 #include <unistd.h>
  37 #include <fcntl.h>
  38 #include "jz4740.h"
  39 #include <stdbool.h>
  40 #include <unistd.h>
  41
  42 #define VERSION "0.4"
  43
  44 #define MAX_FIRMWARESIZE   (64*1024*1024)   /* Arbitrary limit (for safety) */
  45
  46 /* For win32 compatibility: */
  47 #ifndef O_BINARY
  48 #define O_BINARY 0
  49 #endif
  50
  51 /* USB IDs for USB Boot Mode */
  52 #define VID              0x601A
  53 #define PID              0x4740
  54
  55 #define EP_BULK_TO       0x01
  56 #define TOUT             5000
  57
  58 enum USB_JZ4740_REQUEST
  59 {
  60     VR_GET_CPU_INFO = 0,
  61     VR_SET_DATA_ADDRESS,
  62     VR_SET_DATA_LENGTH,
  63     VR_FLUSH_CACHES,
  64     VR_PROGRAM_START1,
  65     VR_PROGRAM_START2,
  66     VR_NOR_OPS,
  67     VR_NAND_OPS,
  68     VR_SDRAM_OPS,
  69     VR_CONFIGURATION
  70 };
  71
  72 enum NOR_OPS_TYPE
  73 {
  74     NOR_INIT = 0,
  75     NOR_QUERY,
  76     NOR_WRITE,
  77     NOR_ERASE_CHIP,
  78     NOR_ERASE_SECTOR
  79 };
  80
  81 enum NOR_FLASH_TYPE
  82 {
  83     NOR_AM29 = 0,
  84     NOR_SST28,
  85     NOR_SST39x16,
  86     NOR_SST39x8
  87 };
  88
  89 enum NAND_OPS_TYPE
  90 {
  91     NAND_QUERY = 0,
  92     NAND_INIT,
  93     NAND_MARK_BAD,
  94     NAND_READ_OOB,
  95     NAND_READ_RAW,
  96     NAND_ERASE,
  97     NAND_READ,
  98     NAND_PROGRAM,
  99     NAND_READ_TO_RAM
 100 };
 101
 102 enum SDRAM_OPS_TYPE
 103 {
 104     SDRAM_LOAD,
 105 };
 106
 107 enum DATA_STRUCTURE_OB
 108 {
 109     DS_flash_info,
 110     DS_hand
 111 };
 112
 113 enum OPTION
 114 {
 115     OOB_ECC,
 116     OOB_NO_ECC,
 117     NO_OOB,
 118 };
 119
 120 int filesize(FILE* fd)
 121 {
 122     int ret;
 123     fseek(fd, 0, SEEK_END);
 124     ret = ftell(fd);
 125     fseek(fd, 0, SEEK_SET);
 126     return ret;
 127 }
 128
 129 #define SEND_COMMAND(cmd, arg) err = usb_control_msg(dh, USB_ENDPOINT_OUT | USB_TYPE_VENDOR, (cmd), (arg)>>16, (arg)&0xFFFF, NULL, 0, TOUT);\
 130                                if (err < 0) \
 131                                { \
 132                                    fprintf(stderr,"\n[ERR]  Error sending control message (%d, %s)\n", err, usb_strerror()); \
 133                                    return -1; \
 134                                }
 135
 136 #define GET_CPU_INFO(s)        err = usb_control_msg(dh, USB_ENDPOINT_IN | USB_TYPE_VENDOR, VR_GET_CPU_INFO, 0, 0, (s), 8, TOUT); \
 137                                if (err < 0) \
 138                                { \
 139                                    fprintf(stderr,"\n[ERR]  Error sending control message (%d, %s)\n", err, usb_strerror()); \
 140                                    return -1; \
 141                                }
 142
 143 #define SEND_DATA(ptr, size)   err = usb_bulk_write(dh, USB_ENDPOINT_OUT | EP_BULK_TO, ((char*)(ptr)), (size), TOUT); \
 144                                if (err != (size))  \
 145                                { \
 146                                    fprintf(stderr,"\n[ERR]  Error writing data\n"); \
 147                                    fprintf(stderr,"[ERR]  Bulk write error (%d, %s)\n", err, strerror(-err)); \
 148                                    return -1; \
 149                                }
 150
 151 #define GET_DATA(ptr, size)    err = usb_bulk_read(dh, USB_ENDPOINT_IN | EP_BULK_TO, ((char*)(ptr)), (size), TOUT); \
 152                                if (err != (size))  \
 153                                { \
 154                                    fprintf(stderr,"\n[ERR]  Error writing data\n"); \
 155                                    fprintf(stderr,"[ERR]  Bulk write error (%d, %s)\n", err, strerror(-err)); \
 156                                    return -1; \
 157                                }
 158
 159 int upload_app(usb_dev_handle* dh, int address, unsigned char* p, int len, bool stage2)
 160 {
 161     int err;
 162     char buf[9];
 163     unsigned char* tmp_buf;
 164
 165     fprintf(stderr, "[INFO] GET_CPU_INFO: ");
 166     GET_CPU_INFO(buf);
 167     buf[8] = 0;
 168     fprintf(stderr, "%s\n", buf);
 169 #if 0
 170     fprintf(stderr, "[INFO] Flushing cache...");
 171     SEND_COMMAND(VR_FLUSH_CACHES, 0);
 172     fprintf(stderr, " Done!\n");
 173 #endif
 174
 175     fprintf(stderr, "[INFO] SET_DATA_ADDRESS to 0x%x...", address);
 176     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 177     fprintf(stderr, " Done!\n");
 178
 179     fprintf(stderr, "[INFO] Sending data...");
 180     /* Must not split the file in several packages! */
 181     SEND_DATA(p, len);
 182     fprintf(stderr, " Done!\n");
 183
 184     fprintf(stderr, "[INFO] Verifying data...");
 185     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 186     SEND_COMMAND(VR_SET_DATA_LENGTH, len);
 187     tmp_buf = malloc(len);
 188     if (tmp_buf == NULL)
 189     {
 190         fprintf(stderr, "\n[ERR]  Could not allocate memory.\n");
 191         return -1;
 192     }
 193     GET_DATA(tmp_buf, len);
 194     if (memcmp(tmp_buf, p, len) != 0)
 195         fprintf(stderr, "\n[WARN] Sent data isn't the same as received data...\n");
 196     else
 197         fprintf(stderr, " Done!\n");
 198     free(tmp_buf);
 199
 200     fprintf(stderr, "[INFO] Booting device [STAGE%d]...", (stage2 ? 2 : 1));
 201     SEND_COMMAND((stage2 ? VR_PROGRAM_START2 : VR_PROGRAM_START1), address );
 202     fprintf(stderr, " Done!\n");
 203
 204     return 0;
 205 }
 206
 207 int read_data(usb_dev_handle* dh, int address, unsigned char *p, int len)
 208 {
 209     int err;
 210     char buf[9];
 211
 212     fprintf(stderr, "[INFO] GET_CPU_INFO: ");
 213     GET_CPU_INFO(buf);
 214     buf[8] = 0;
 215     fprintf(stderr, "%s\n", buf);
 216
 217     fprintf(stderr, "[INFO] Reading data...");
 218     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 219     SEND_COMMAND(VR_SET_DATA_LENGTH, len);
 220     GET_DATA(p, len);
 221     fprintf(stderr, " Done!\n");
 222     return 0;
 223 }
 224
 225 unsigned int read_reg(usb_dev_handle* dh, int address, int size)
 226 {
 227     int err;
 228     unsigned char buf[4];
 229
 230     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 231     SEND_COMMAND(VR_SET_DATA_LENGTH, size);
 232     GET_DATA(buf, size);
 233
 234     if(size == 1)
 235         return buf[0];
 236     else if(size == 2)
 237         return (buf[1] << 8) | buf[0];
 238     else if(size == 4)
 239         return (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
 240     else
 241         return 0;
 242 }
 243
 244 int set_reg(usb_dev_handle* dh, int address, unsigned int val, int size)
 245 {
 246     int err, i;
 247     unsigned char buf[4];
 248
 249     buf[0] = val & 0xff;
 250     if(i > 1)
 251     {
 252         buf[1] = (val >> 8) & 0xff;
 253         if(i > 2)
 254         {
 255             buf[2] = (val >> 16) & 0xff;
 256             buf[3] = (val >> 24) & 0xff;
 257         }
 258     }
 259
 260     SEND_COMMAND(VR_SET_DATA_ADDRESS, address);
 261     SEND_DATA(buf, size);
 262
 263     return 0;
 264 }
 265 #define or_reg(dh, adr, val, size) set_reg(dh, adr, (read_reg(dh, adr, size) | (val)), size);
 266 #define and_reg(dh, adr, val, size) set_reg(dh, adr, (read_reg(dh, adr, size) & (val)), size);
 267 #define bc_reg(dh, adr, val, size) set_reg(dh, adr, (read_reg(dh, adr, size) & ~(val)), size);
 268 #define xor_reg(dh, adr, val, size) set_reg(dh, adr, (read_reg(dh, adr, size) ^ (val)), size);
 269
 270 #define TEST(m, size) fprintf(stderr, "%s -> %x\n", #m, read_reg(dh, m, size));
 271 int test_device(usb_dev_handle* dh)
 272 {
 273     TEST(INTC_ISR, 4);
 274     TEST(INTC_IMR, 4);
 275     TEST(INTC_IMSR, 4);
 276     TEST(INTC_IMCR, 4);
 277     TEST(INTC_IPR, 4);
 278
 279     fprintf(stderr, "\n");
 280     TEST(RTC_RCR, 4);
 281     TEST(RTC_RSR, 4);
 282     TEST(RTC_RSAR, 4);
 283     TEST(RTC_RGR, 4);
 284     TEST(RTC_HCR, 4);
 285     TEST(RTC_RCR, 4);
 286     TEST(RTC_HWFCR, 4);
 287     TEST(RTC_HRCR, 4);
 288     TEST(RTC_HWCR, 4);
 289     TEST(RTC_HWSR, 4);
 290
 291     fprintf(stderr, "\n");
 292     TEST(GPIO_PXPIN(0), 4);
 293     TEST(GPIO_PXPIN(1), 4);
 294     TEST(GPIO_PXPIN(2), 4);
 295     TEST(GPIO_PXPIN(3), 4);
 296
 297     fprintf(stderr, "\n");
 298     TEST(CPM_CLKGR, 4);
 299
 300     fprintf(stderr, "\n");
 301     TEST(SADC_ENA, 1);
 302     TEST(SADC_CTRL, 1);
 303     TEST(SADC_TSDAT, 4);
 304     TEST(SADC_BATDAT, 2);
 305     TEST(SADC_STATE, 1);
 306
 307     fprintf(stderr, "\n");
 308
 309     TEST(SLCD_CFG, 4);
 310     TEST(SLCD_CTRL, 1);
 311     TEST(SLCD_STATE, 1);
 312
 313     return 0;
 314 }
 315
 316 #define VOL_DOWN (1 << 27)
 317 #define VOL_UP (1 << 0)
 318 #define MENU (1 << 1)
 319 #define HOLD (1 << 16)
 320 #define OFF (1 << 29)
 321 #define MASK (VOL_DOWN|VOL_UP|MENU|HOLD|OFF)
 322 #define TS_MASK (SADC_STATE_PEND|SADC_STATE_PENU|SADC_STATE_TSRDY)
 323 int probe_device(usb_dev_handle* dh)
 324 {
 325     int tmp;
 326
 327     while(1)
 328     {
 329         if(read_reg(dh, SADC_STATE, 1) & SADC_STATE_TSRDY)
 330         {
 331             printf("%x\n", read_reg(dh, SADC_TSDAT, 4));
 332             or_reg(dh, SADC_CTRL, read_reg(dh, SADC_STATE, 1) & TS_MASK, 1);
 333         }
 334
 335         tmp = read_reg(dh, GPIO_PXPIN(3), 4);
 336         if(tmp < 0)
 337             return tmp;
 338         if(tmp ^ MASK)
 339         {
 340             if(!(tmp & VOL_DOWN))
 341                 printf("VOL_DOWN\t");
 342             if(!(tmp & VOL_UP))
 343                 printf("VOL_UP\t");
 344             if(!(tmp & MENU))
 345                 printf("MENU\t");
 346             if(!(tmp & OFF))
 347                 printf("OFF\t");
 348             if(!(tmp & HOLD))
 349                 printf("HOLD\t");
 350             printf("\n");
 351         }
 352     }
 353     return 0;
 354 }
 355
 356 unsigned int read_file(const char *name, unsigned char **buffer)
 357 {
 358     FILE *fd;
 359     int len, n;
 360
 361     fd = fopen(name, "rb");
 362     if (fd == NULL)
 363     {
 364         fprintf(stderr, "[ERR]  Could not open %s\n", name);
 365         return 0;
 366     }
 367
 368     len = filesize(fd);
 369
 370     *buffer = (unsigned char*)malloc(len);
 371     if (*buffer == NULL)
 372     {
 373         fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 374         fclose(fd);
 375         return 0;
 376     }
 377
 378     n = fread(*buffer, 1, len, fd);
 379     if (n != len)
 380     {
 381         fprintf(stderr, "[ERR]  Short read.\n");
 382         fclose(fd);
 383         return 0;
 384     }
 385     fclose(fd);
 386
 387     return len;
 388 }
 389 #define _GET_CPU fprintf(stderr, "[INFO] GET_CPU_INFO:"); \
 390                  GET_CPU_INFO(cpu); \
 391                  cpu[8] = 0; \
 392                  fprintf(stderr, " %s\n", cpu);
 393 #define _SET_ADDR(a) fprintf(stderr, "[INFO] Set address to 0x%x...", a); \
 394                      SEND_COMMAND(VR_SET_DATA_ADDRESS, a); \
 395                      fprintf(stderr, " Done!\n");
 396 #define _SEND_FILE(a) fsize = read_file(a, &buffer); \
 397                       if(fsize == 0) \
 398                         return -1; \
 399                       fprintf(stderr, "[INFO] Sending file %s: %d bytes...", a, fsize); \
 400                       SEND_DATA(buffer, fsize); \
 401                       free(buffer); \
 402                       fprintf(stderr, " Done!\n");
 403 #define _VERIFY_DATA(a,c) fprintf(stderr, "[INFO] Verifying data (%s)...", a); \
 404                           fsize = read_file(a, &buffer); \
 405                           if(fsize == 0) \
 406                             return -1; \
 407                           buffer2 = (unsigned char*)malloc(fsize); \
 408                           SEND_COMMAND(VR_SET_DATA_ADDRESS, c); \
 409                           SEND_COMMAND(VR_SET_DATA_LENGTH,  fsize); \
 410                           GET_DATA(buffer2, fsize); \
 411                           if(memcmp(buffer, buffer2, fsize) != 0) \
 412                               fprintf(stderr, "\n[WARN] Sent data isn't the same as received data...\n"); \
 413                           else \
 414                               fprintf(stderr, " Done!\n"); \
 415                           free(buffer); \
 416                           free(buffer2);
 417 #define _STAGE1(a)     fprintf(stderr, "[INFO] Stage 1 at 0x%x\n", a); \
 418                        SEND_COMMAND(VR_PROGRAM_START1, a);
 419 #define _STAGE2(a)     fprintf(stderr, "[INFO] Stage 2 at 0x%x\n", a); \
 420                        SEND_COMMAND(VR_PROGRAM_START2, a);
 421 #define _FLUSH         fprintf(stderr, "[INFO] Flushing caches...\n"); \
 422                        SEND_COMMAND(VR_FLUSH_CACHES, 0);
 423 #ifdef _WIN32
 424  #define _SLEEP(x) Sleep(x*1000);
 425 #else
 426  #define _SLEEP(x) sleep(x);
 427 #endif
 428 int mimic_of(usb_dev_handle *dh, bool vx767)
 429 {
 430     int err, fsize;
 431     unsigned char *buffer, *buffer2;
 432     char cpu[8];
 433
 434     fprintf(stderr, "[INFO] Start!\n");
 435     _GET_CPU;
 436     _SET_ADDR(0x8000 << 16);
 437     _SEND_FILE("1.bin");
 438     _GET_CPU;
 439     _VERIFY_DATA("1.bin", 0x8000 << 16);
 440     _STAGE1(0x8000 << 16);
 441     _SLEEP(3);
 442     _VERIFY_DATA("2.bin", 0xB3020060);
 443     _GET_CPU;
 444     _GET_CPU;
 445     _FLUSH;
 446     _GET_CPU;
 447     _GET_CPU;
 448     _SET_ADDR(0x8000 << 16);
 449     _SEND_FILE("3.bin");
 450     _GET_CPU;
 451     _VERIFY_DATA("3.bin", 0x8000 << 16);
 452     _GET_CPU;
 453     _FLUSH;
 454     _GET_CPU;
 455     _GET_CPU;
 456     _SET_ADDR(0x80D0 << 16);
 457     _SEND_FILE("4.bin");
 458     _GET_CPU;
 459     _VERIFY_DATA("4.bin", 0x80D0 << 16);
 460     _GET_CPU;
 461     _FLUSH;
 462     _GET_CPU;
 463     _GET_CPU;
 464     _SET_ADDR(0x80E0 << 16);
 465     _SEND_FILE("5.bin");
 466     _GET_CPU;
 467     _VERIFY_DATA("5.bin", 0x80E0 << 16);
 468     _GET_CPU;
 469     _FLUSH;
 470     _GET_CPU;
 471     _GET_CPU;
 472     _SET_ADDR(0x80004000);
 473     _SEND_FILE("6.bin");
 474     _GET_CPU;
 475     _VERIFY_DATA("6.bin", 0x80004000);
 476     _GET_CPU;
 477     _FLUSH;
 478     _GET_CPU;
 479     _GET_CPU;
 480     _SET_ADDR(0x80FD << 16);
 481     _SEND_FILE("7.bin");
 482     _GET_CPU;
 483     _VERIFY_DATA("7.bin", 0x80FD << 16);
 484     _GET_CPU;
 485     _FLUSH;
 486     _GET_CPU;
 487     _STAGE2(0x80FD0004);
 488     _VERIFY_DATA("8.bin", 0x80004004);
 489     _VERIFY_DATA("9.bin", 0x80004008);
 490     _SLEEP(2);
 491     _GET_CPU;
 492     _SET_ADDR(0x80E0 << 16);
 493     _SEND_FILE("10.bin");
 494     _GET_CPU;
 495     _VERIFY_DATA("10.bin", 0x80E0 << 16);
 496     _GET_CPU;
 497     _FLUSH;
 498     _GET_CPU;
 499     if(vx767)
 500     {
 501         _STAGE2(0x80E10008);
 502     }
 503     else
 504     {
 505         _STAGE2(0x80E00008);
 506     }
 507     fprintf(stderr, "[INFO] Done!\n");
 508     return 0;
 509 }
 510
 511 int send_rockbox(usb_dev_handle *dh)
 512 {
 513     int err, fsize;
 514     unsigned char *buffer, *buffer2;
 515     char cpu[8];
 516
 517     fprintf(stderr, "[INFO] Start!\n");
 518     _GET_CPU;
 519     _SET_ADDR(0x8000 << 16);
 520     _SEND_FILE("1.bin");
 521     _GET_CPU;
 522     _VERIFY_DATA("1.bin", 0x8000 << 16);
 523     _STAGE1(0x8000 << 16);
 524     _SLEEP(3);
 525     _GET_CPU;
 526     _SET_ADDR(0x080004000);
 527     _SEND_FILE("onda.bin");
 528     _GET_CPU;
 529     _VERIFY_DATA("onda.bin", 0x080004000);
 530     _GET_CPU;
 531     _FLUSH;
 532     _GET_CPU;
 533     _STAGE2(0x080004008);
 534     fprintf(stderr, "[INFO] Done!\n");
 535     return 0;
 536 }
 537
 538 #define SEND_NAND_COMMAND(cs, cmd, option) SEND_COMMAND(VR_NAND_OPS, ((cmd&0xF)|((cs&0xFF)<<4)|((option&0xFF)<<12)) );
 539 #define LENGTH 1024*1024*5
 540 int nand_dump(usb_dev_handle *dh)
 541 {
 542     int err;
 543     unsigned int n;
 544     FILE *fd;
 545     unsigned char* buffer;
 546
 547     fd = fopen("nand_dump.bin", "wb");
 548     if (fd == NULL)
 549     {
 550         fprintf(stderr, "[ERR]  Could not open nand_dump.bin\n");
 551         return 0;
 552     }
 553
 554     buffer = (unsigned char*)malloc(LENGTH);
 555     if (buffer == NULL)
 556     {
 557         fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 558         fclose(fd);
 559         return 0;
 560     }
 561     memset(buffer, 0, LENGTH);
 562
 563     SEND_NAND_COMMAND(0, NAND_INIT, 0);
 564     /*
 565     fprintf(stderr, "[INFO] Querying NAND...\n");
 566     SEND_NAND_COMMAND(0, NAND_QUERY, 0);
 567     GET_DATA(buffer, 4);
 568     printf("[INFO] %x %x %x %x\n", buffer[0], buffer[1], buffer[2], buffer[3]);
 569     */
 570     SEND_COMMAND(VR_SET_DATA_ADDRESS, 0);
 571     SEND_COMMAND(VR_SET_DATA_LENGTH, LENGTH);
 572     SEND_NAND_COMMAND(0, NAND_READ, NO_OOB);
 573
 574     fprintf(stderr, "[INFO] Reading data...\n");
 575     err = usb_bulk_read(dh, USB_ENDPOINT_IN | EP_BULK_TO, (char*)buffer, LENGTH, TOUT);
 576     if (err != LENGTH)
 577     {
 578         fprintf(stderr,"\n[ERR]  Error writing data\n");
 579         fprintf(stderr,"[ERR]  Bulk write error (%d, %s)\n", err, strerror(-err));
 580         fclose(fd);
 581         free(buffer);
 582         return -1;
 583     }
 584
 585     n = fwrite(buffer, 1, LENGTH, fd);
 586     if (n != LENGTH)
 587     {
 588         fprintf(stderr, "[ERR]  Short write.\n");
 589         fclose(fd);
 590         free(buffer);
 591         return 0;
 592     }
 593     fclose(fd);
 594     free(buffer);
 595
 596     return n;
 597 }
 598 #undef LENGTH
 599
 600 #define LENGTH 0x1000*16
 601 int rom_dump(usb_dev_handle *dh)
 602 {
 603     int err;
 604     unsigned int n;
 605     FILE *fd;
 606     unsigned char* buffer;
 607
 608     fd = fopen("rom_dump.bin", "wb");
 609     if (fd == NULL)
 610     {
 611         fprintf(stderr, "[ERR]  Could not open rom_dump.bin\n");
 612         return 0;
 613     }
 614
 615     buffer = (unsigned char*)malloc(LENGTH);
 616     if (buffer == NULL)
 617     {
 618         fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 619         fclose(fd);
 620         return 0;
 621     }
 622     memset(buffer, 0, LENGTH);
 623
 624     SEND_COMMAND(VR_SET_DATA_ADDRESS, 0x1FC00000);
 625     SEND_COMMAND(VR_SET_DATA_LENGTH, LENGTH);
 626
 627     fprintf(stderr, "[INFO] Reading data...\n");
 628     err = usb_bulk_read(dh, USB_ENDPOINT_IN | EP_BULK_TO, (char*)buffer, LENGTH, TOUT);
 629     if (err != LENGTH)
 630     {
 631         fprintf(stderr,"\n[ERR]  Error writing data\n");
 632         fprintf(stderr,"[ERR]  Bulk write error (%d, %s)\n", err, strerror(-err));
 633         fclose(fd);
 634         free(buffer);
 635         return -1;
 636     }
 637
 638     n = fwrite(buffer, 1, LENGTH, fd);
 639     if (n != LENGTH)
 640     {
 641         fprintf(stderr, "[ERR]  Short write.\n");
 642         fclose(fd);
 643         free(buffer);
 644         return 0;
 645     }
 646     fclose(fd);
 647     free(buffer);
 648
 649     return n;
 650 }
 651
 652 int jzconnect(int address, unsigned char* buf, int len, int func)
 653 {
 654     struct usb_bus *bus;
 655     struct usb_device *tmp_dev;
 656     struct usb_device *dev = NULL;
 657     usb_dev_handle *dh;
 658     int err;
 659
 660     fprintf(stderr,"[INFO] Searching for device...\n");
 661
 662     usb_init();
 663     if(usb_find_busses() < 0)
 664     {
 665         fprintf(stderr, "[ERR]  Could not find any USB busses.\n");
 666         return -2;
 667     }
 668
 669     if (usb_find_devices() < 0)
 670     {
 671         fprintf(stderr, "[ERR]  USB devices not found(nor hubs!).\n");
 672         return -3;
 673     }
 674
 675     for (bus = usb_get_busses(); bus; bus = bus->next)
 676     {
 677         for (tmp_dev = bus->devices; tmp_dev; tmp_dev = tmp_dev->next)
 678         {
 679             if (tmp_dev->descriptor.idVendor == VID &&
 680                 tmp_dev->descriptor.idProduct == PID)
 681             {
 682                 dev = tmp_dev;
 683                 goto found;
 684             }
 685         }
 686     }
 687
 688     if (dev == NULL)
 689     {
 690         fprintf(stderr, "[ERR]  Device not found.\n");
 691         fprintf(stderr, "[ERR]  Ensure your device is in USB boot mode and run usbtool again.\n");
 692         return -4;
 693     }
 694
 695 found:
 696     if ( (dh = usb_open(dev)) == NULL)
 697     {
 698         fprintf(stderr,"[ERR]  Unable to open device.\n");
 699         return -5;
 700     }
 701
 702 /* usb_set_configuration() calls are already done in Linux */
 703 #ifdef _WIN32
 704     err = usb_set_configuration(dh, 1);
 705
 706     if (err < 0)
 707     {
 708         fprintf(stderr, "[ERR]  usb_set_configuration failed (%d, %s)\n", err, usb_strerror());
 709         usb_close(dh);
 710         return -6;
 711     }
 712 #endif
 713
 714     /* "must be called" written in the libusb documentation */
 715     err = usb_claim_interface(dh, 0);
 716     if (err < 0)
 717     {
 718         fprintf(stderr, "[ERR]  Unable to claim interface (%d, %s)\n", err, usb_strerror());
 719         usb_close(dh);
 720         return -7;
 721     }
 722
 723     fprintf(stderr,"[INFO] Found device, uploading application.\n");
 724
 725     /* Now we can transfer the application to the device. */
 726
 727     switch(func)
 728     {
 729         case 1:
 730         case 5:
 731             err = upload_app(dh, address, buf, len, (func == 5));
 732         break;
 733         case 2:
 734             err = read_data(dh, address, buf, len);
 735         break;
 736         case 3:
 737             err = test_device(dh);
 738         break;
 739         case 4:
 740             err = probe_device(dh);
 741         break;
 742         case 6:
 743         case 7:
 744             err = mimic_of(dh, (func == 7));
 745         break;
 746         case 8:
 747             err = nand_dump(dh);
 748         break;
 749         case 9:
 750             err = rom_dump(dh);
 751         break;
 752         case 10:
 753             err = send_rockbox(dh);
 754         break;
 755     }
 756
 757     /* release claimed interface */
 758     usb_release_interface(dh, 0);
 759
 760     usb_close(dh);
 761
 762     return err;
 763 }
 764
 765 void print_usage(void)
 766 {
 767 #ifdef _WIN32
 768     fprintf(stderr, "Usage: usbtool.exe <CMD> [FILE] [ADDRESS] [LEN]\n");
 769 #else
 770     fprintf(stderr, "Usage: usbtool <CMD> [FILE] [ADDRESS] [LEN]\n");
 771 #endif
 772
 773     fprintf(stderr, "\t[ADDRESS] has to be in 0xHEXADECIMAL format\n");
 774     fprintf(stderr, "\tCMD:\n");
 775     fprintf(stderr, "\t\t 1 -> upload file to specified address and boot from it\n");
 776     fprintf(stderr, "\t\t 2 -> read data from [ADDRESS] with length [LEN] to [FILE]\n");
 777     fprintf(stderr, "\t\t 3 -> read device status\n");
 778     fprintf(stderr, "\t\t 4 -> probe keys (only Onda VX747)\n");
 779     fprintf(stderr, "\t\t 5 -> same as 1 but do a stage 2 boot\n");
 780     fprintf(stderr, "\t\t 6 -> mimic VX747 OF fw recovery\n");
 781     fprintf(stderr, "\t\t 7 -> mimic VX767 OF fw recovery\n");
 782     fprintf(stderr, "\t\t 8 -> do a NAND dump\n");
 783     fprintf(stderr, "\t\t 9 -> do a ROM dump\n");
 784     fprintf(stderr, "\t\t10 -> send Rockbox bootloader to SDRAM\n");
 785
 786 #ifdef _WIN32
 787     fprintf(stderr, "\nExample:\n\t usbtool.exe 1 fw.bin 0x80000000\n");
 788     fprintf(stderr, "\t usbtool.exe 2 save.bin 0x81000000 1024\n");
 789 #else
 790     fprintf(stderr, "\nExample:\n\t usbtool 1 fw.bin 0x80000000\n");
 791     fprintf(stderr, "\t usbtool 2 save.bin 0x81000000 1024\n");
 792 #endif
 793 }
 794
 795 int main(int argc, char* argv[])
 796 {
 797     unsigned char* buf;
 798     int n, len, address, cmd=0;
 799     FILE* fd;
 800
 801     fprintf(stderr, "USBtool v" VERSION " - (C) 2008 Maurus Cuelenaere\n");
 802     fprintf(stderr, "This is free software; see the source for copying conditions.  There is NO\n");
 803     fprintf(stderr, "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.\n\n");
 804
 805     if(argc > 1)
 806         sscanf(argv[1], "%d", &cmd);
 807     switch(cmd)
 808     {
 809         case 5:
 810         case 1:
 811             if (strcmp(argv[3], "-1") == 0)
 812                 address = 0x80000000;
 813             else
 814             {
 815                 if (sscanf(argv[3], "0x%x", &address) <= 0)
 816                 {
 817                     print_usage();
 818                     return -1;
 819                 }
 820             }
 821
 822             fd = fopen(argv[2], "rb");
 823             if (fd < 0)
 824             {
 825                 fprintf(stderr, "[ERR]  Could not open %s\n", argv[2]);
 826                 return 4;
 827             }
 828
 829             len = filesize(fd);
 830
 831             if (len > MAX_FIRMWARESIZE)
 832             {
 833                 fprintf(stderr, "[ERR]  Firmware file too big\n");
 834                 fclose(fd);
 835                 return 5;
 836             }
 837
 838             buf = malloc(len);
 839             if (buf == NULL)
 840             {
 841                 fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 842                 fclose(fd);
 843                 return 6;
 844             }
 845
 846             n = fread(buf, 1, len, fd);
 847             if (n != len)
 848             {
 849                 fprintf(stderr, "[ERR]  Short read.\n");
 850                 fclose(fd);
 851                 return 7;
 852             }
 853             fclose(fd);
 854
 855             fprintf(stderr, "[INFO] File size: %d bytes\n", n);
 856
 857             return jzconnect(address, buf, len, cmd);
 858         break;
 859         case 2:
 860             if (sscanf(argv[3], "0x%x", &address) <= 0)
 861             {
 862                 print_usage();
 863                 return -1;
 864             }
 865
 866             fd = fopen(argv[2], "wb");
 867             if (fd < 0)
 868             {
 869                 fprintf(stderr, "[ERR]  Could not open %s\n", argv[2]);
 870                 return 4;
 871             }
 872
 873             sscanf(argv[4], "%d", &len);
 874
 875             buf = malloc(len);
 876             if (buf == NULL)
 877             {
 878                 fprintf(stderr, "[ERR]  Could not allocate memory.\n");
 879                 fclose(fd);
 880                 return 6;
 881             }
 882
 883             int err = jzconnect(address, buf, len, 2);
 884
 885             n = fwrite(buf, 1, len, fd);
 886             if (n != len)
 887             {
 888                 fprintf(stderr, "[ERR]  Short write.\n");
 889                 fclose(fd);
 890                 return 7;
 891             }
 892             fclose(fd);
 893
 894             return err;
 895         break;
 896         case 3:
 897         case 4:
 898         case 6:
 899         case 7:
 900         case 8:
 901         case 9:
 902         case 10:
 903             return jzconnect(address, NULL, 0, cmd);
 904         break;
 905         default:
 906             print_usage();
 907             return 1;
 908         break;
 909     }
 910
 911     return 0;
 912 }