-
Notifications
You must be signed in to change notification settings - Fork 5
/
wrt54g.c
1766 lines (1430 loc) · 66.2 KB
/
wrt54g.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// **************************************************************************
//
// WRT54G.C - WRT54G/GS EJTAG Debrick Utility v4.8
//
// Note:
// This program is for De-Bricking the WRT54G/GS and other misc routers.
//
// New for v4.8 - Added 2 new Flash Chip Parts to the list:
// - SST39VF6401B 4Mx16 BotB (8MB)
// - SST39VF6402B 4Mx16 TopB (8MB)
// - Added the following New Switch Options
// - /wiggler ........... use wiggler cable
//
// New for v4.7 - Added 2 new Flash Chip Parts to the list:
// - K8D3216UTC 2Mx16 TopB (4MB)
// - K8D3216UBC 2Mx16 BotB (4MB)
//
// New for v4.6 - Added Common Flash Chip Polling routine
// - Added "-probeonly" parameter (good idea jmranger)
// - Added Chip ID for Broadcom BCM4704 Rev 8 CPU
// - Added TRST Signal Support for Wiggler Cables
// - Added Chip ID for BRECIS MSP2007-CA-A1 CPU
// - Added Experimental 1MB Flash Chip Offsets
// - Added 2 new Flash Chip Parts to the list:
// - MX29LV800BTC 512kx16 TopB (1MB)
// - MX29LV800BTC 512kx16 BotB (1MB)
//
// New for v4.5 - Added 2 new Flash Chip Parts to the list:
// - K8D1716UTC 1Mx16 TopB (2MB)
// - K8D1716UBC 1Mx16 BotB (2MB)
//
// New for v4.4 - Added PrAcc routines to support additional MIPS chips
// without the ability to use EJTAG DMA Access
// - Added Chip ID for Broadcom BCM5365 Rev 1 CPU
// - Added Chip ID for Broadcom BCM6348 Rev 1 CPU (Big Endian)
// - Added Chip ID for Broadcom BCM6345 Rev 1 CPU
// - Added 6 new Flash Chip Parts to the list:
// - SST39VF1601 1Mx16 BotB (2MB)
// - SST39VF1602 1Mx16 TopB (2MB)
// - SST39VF3201 2Mx16 BotB (4MB)
// - SST39VF3202 2Mx16 TopB (4MB)
// - SST39VF6401 4Mx16 BotB (8MB)
// - SST39VF6402 4Mx16 TopB (8MB)
// - Added the following New Switch Options
// - /noemw ............. prevent Enabling Memory Writes
// - /nocwd ............. prevent Clearing CPU Watchdog Timer
// - /dma ............... force use of DMA routines
// - /nodma ............. force use of PRACC routines (No DMA)
// - /window:XXXXXXXX ... custom flash window base (in HEX)
// - /start:XXXXXXXX .... custom start location (in HEX)
// - /length:XXXXXXXX ... custom length (in HEX)
// - /silent ............ prevent scrolling display of data
// - /skipdetect ........ skip auto detection of CPU Chip ID
// - /instrlen:XX ....... set instruction length manually
// - Added elapsed time to Backup, Erase, and Flash routines
// - Other minor miscellaneous changes/additions.
//
// New for v4.3 - Corrected Macronix Flash Chip Block Definitions.
// - Add 8 new Flash Chip Parts to the list:
// - AT49BV/LV16X 2Mx16 BotB (4MB)
// - AT49BV/LV16XT 2Mx16 TopB (4MB)
// - MBM29LV160B 1Mx16 BotB (2MB)
// - MBM29LV160T 1Mx16 TopB (2MB)
// - MX29LV161B 1Mx16 BotB (2MB)
// - MX29LV161T 1Mx16 TopB (2MB)
// - ST M29W160EB 1Mx16 BotB (2MB)
// - ST M29W160ET 1Mx16 TopB (2MB)
//
// New for v4.2 - Changed the chip_detect routine to allow for easier
// additions of new chip id's.
// - Added detection support for the Broadcom BCM5350 chip.
// - Fixed DMA routines to check status bit that was
// removed in prior version.
// - Removed clockout routine in an effort to speed up access.
// - Changed clockin routine in an effort to speed up access.
// - Changed ReadData and WriteData routines to merely call
// ReadWriteData routine.
// - Removed Defines from .h file and placed flash areas in a
// structure list for easier maintenance should they change.
// - Miscellaneous other minor changes.
//
// **************************************************************************
//
// wrt54g: read/write flash memory via EJTAG
// usage: wrt54g [parameter] </noreset> </noemw> </nocwd> </nobreak> </noerase>
// </notimestamp> </dma> </nodma>
// <start:XXXXXXXX> </length:XXXXXXXX>
// </silent> </skipdetect> </instrlen:XX> </fc:XX>
//
// Required Parameter
// ------------------
// -backup:cfe
// -backup:nvram
// -backup:kernel
// -backup:wholeflash
// -backup:custom
// -erase:cfe
// -erase:nvram
// -erase:kernel
// -erase:wholeflash
// -erase:custom
// -flash:cfe
// -flash:nvram
// -flash:kernel
// -flash:wholeflash
// -flash:custom
// -probeonly
//
// Optional Switches
// -----------------
// /noreset ........... prevent Issuing EJTAG CPU reset
// /noemw ............. prevent Enabling Memory Writes
// /nocwd ............. prevent Clearing CPU Watchdog Timer
// /nobreak ........... prevent Issuing Debug Mode JTAGBRK
// /noerase ........... prevent Forced Erase before Flashing
// /notimestamp ....... prevent Timestamping of Backups
// /dma ............... force use of DMA routines
// /nodma ............. force use of PRACC routines (No DMA)
// /start:XXXXXXXX .... custom start location (in HEX)
// /length:XXXXXXXX ... custom length (in HEX)
// /silent ............ prevent scrolling display of data
// /skipdetect ........ skip auto detection of CPU Chip ID
// /instrlen:XX ....... set instruction length manually
// /wiggler ........... use wiggler cable
// /fc:XX = Optional (Manual) Flash Chip Selection
//
// **************************************************************************
// Written by HairyDairyMaid (a.k.a. - lightbulb)
// **************************************************************************
//
// This program is copyright (C) 2004 HairyDairyMaid (a.k.a. Lightbulb)
// This program is free software; you can redistribute it and/or modify it
// under the terms of version 2 the GNU General Public License as published
// by the Free Software Foundation.
// This program is distributed in the hope that it will be useful, but WITHOUT
// ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
// FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
// more details.
// To view a copy of the license go to:
// http://www.fsf.org/copyleft/gpl.html
// To receive a copy of the GNU General Public License write the Free Software
// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
//
// **************************************************************************
// Default is Compile for Linux (both #define's below should be commented out)
// #define WINDOWS_VERSION // uncomment only this for Windows Compile / MS Visual C Compiler
// #define __FreeBSD__ // uncomment only this for FreeBSD
#ifdef WINDOWS_VERSION
#include <windows.h> // Only for Windows Compile
#define strcasecmp stricmp
#define strncasecmp strnicmp
#endif
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include "wrt54g.h"
static unsigned int ctrl_reg;
int pfd;
int instruction_length;
int issue_reset = 1;
int issue_enable_mw = 1;
int issue_watchdog = 1;
int issue_break = 1;
int issue_erase = 1;
int issue_timestamp = 1;
int force_dma = 0;
int force_nodma = 0;
int selected_fc = 0;
unsigned int selected_window = 0;
unsigned int selected_start = 0;
unsigned int selected_length = 0;
int custom_options = 0;
int silent_mode = 0;
int skipdetect = 0;
int instrlen = 0;
int wiggler = 0;
char flash_part[128];
unsigned int flash_size = 0;
int block_total = 0;
unsigned int block_addr = 0;
unsigned int blocks[1024];
unsigned int cmd_type = 0;
char AREA_NAME[128];
unsigned int AREA_START;
unsigned int AREA_LENGTH;
unsigned int FLASH_MEMORY_START;
unsigned int vendid;
unsigned int devid;
unsigned int data_register;
unsigned int address_register;
int USE_DMA = 0;
int ejtag_version = 0;
typedef struct _processor_chip_type {
unsigned int chip_id; // Processor Chip ID
int instr_length; // EJTAG Instruction Length
char* chip_descr; // Processor Chip Description
} processor_chip_type;
processor_chip_type processor_chip_list[] = {
{ 0x0471017F, 5, "Broadcom BCM4702 Rev 1 CPU" },
{ 0x1471217F, 8, "Broadcom BCM4712 Rev 1 CPU" },
{ 0x2471217F, 8, "Broadcom BCM4712 Rev 2 CPU" },
{ 0x0535017F, 8, "Broadcom BCM5350 Rev 1 CPU" },
{ 0x0535217F, 8, "Broadcom BCM5352 Rev 1 CPU" },
{ 0x0536517F, 8, "Broadcom BCM5365 Rev 1 CPU" }, // BCM5365 Not Completely Verified Yet
{ 0x0634817F, 5, "Broadcom BCM6348 Rev 1 CPU" },
{ 0x0634517F, 5, "Broadcom BCM6345 Rev 1 CPU" }, // BCM6345 Not Completely Verified Yet
{ 0x0000100F, 5, "TI AR7WRD TNETD7300GDU Rev 1 CPU" }, // TI AR7WRD Only Partially Verified
{ 0x0470417F, 8, "Broadcom BCM4704 Rev 8 CPU" }, // BCM4704 chip (used in the WRTSL54GS units)
{ 0x102002E1, 5, "BRECIS MSP2007-CA-A1 CPU" }, // BRECIS chip - Not Completely Verified Yet
{ 0, 0, 0 }
};
typedef struct _flash_area_type {
unsigned int chip_size;
char* area_name;
unsigned int area_start;
unsigned int area_length;
} flash_area_type;
flash_area_type flash_area_list[] = {
//--------- ---------- ----------- ------------
//chip_size area_name area_start area_length
//--------- ---------- ----------- ------------
{ size1MB, "CFE", 0x1FC00000, 0x40000 },
{ size2MB, "CFE", 0x1FC00000, 0x40000 },
{ size4MB, "CFE", 0x1FC00000, 0x40000 },
{ size8MB, "CFE", 0x1C000000, 0x40000 },
{ size16MB, "CFE", 0x1C000000, 0x40000 },
{ size1MB, "KERNEL", 0x1FC40000, 0xB0000 },
{ size2MB, "KERNEL", 0x1FC40000, 0x1B0000 },
{ size4MB, "KERNEL", 0x1FC40000, 0x3B0000 },
{ size8MB, "KERNEL", 0x1C040000, 0x7A0000 },
{ size16MB, "KERNEL", 0x1C040000, 0x7A0000 },
{ size1MB, "NVRAM", 0x1FCF0000, 0x10000 },
{ size2MB, "NVRAM", 0x1FDF0000, 0x10000 },
{ size4MB, "NVRAM", 0x1FFF0000, 0x10000 },
{ size8MB, "NVRAM", 0x1C7E0000, 0x20000 },
{ size16MB, "NVRAM", 0x1C7E0000, 0x20000 },
{ size1MB, "WHOLEFLASH", 0x1FC00000, 0x100000 },
{ size2MB, "WHOLEFLASH", 0x1FC00000, 0x200000 },
{ size4MB, "WHOLEFLASH", 0x1FC00000, 0x400000 },
{ size8MB, "WHOLEFLASH", 0x1C000000, 0x800000 },
{ size16MB, "WHOLEFLASH", 0x1C000000, 0x800000 },
{ 0, 0, 0, 0 }
};
typedef struct _flash_chip_type {
unsigned int vendid; // Manufacturer Id
unsigned int devid; // Device Id
unsigned int flash_size; // Total size in MBytes
unsigned int cmd_type; // Device CMD TYPE
char* flash_part; // Flash Chip Description
unsigned int region1_num; // Region 1 block count
unsigned int region1_size; // Region 1 block size
unsigned int region2_num; // Region 2 block count
unsigned int region2_size; // Region 2 block size
unsigned int region3_num; // Region 3 block count
unsigned int region3_size; // Region 3 block size
unsigned int region4_num; // Region 4 block count
unsigned int region4_size; // Region 4 block size
} flash_chip_type;
flash_chip_type flash_chip_list[] = {
{ 0x0001, 0x2249, size2MB, CMD_TYPE_AMD, "AMD 29lv160DB 1Mx16 BotB (2MB)" ,1,size16K, 2,size8K, 1,size32K, 31,size64K },
{ 0x0001, 0x22c4, size2MB, CMD_TYPE_AMD, "AMD 29lv160DT 1Mx16 TopB (2MB)" ,31,size64K, 1,size32K, 2,size8K, 1,size16K },
{ 0x0001, 0x22f9, size4MB, CMD_TYPE_AMD, "AMD 29lv320DB 2Mx16 BotB (4MB)" ,8,size8K, 63,size64K, 0,0, 0,0 },
{ 0x0001, 0x22f6, size4MB, CMD_TYPE_AMD, "AMD 29lv320DT 2Mx16 TopB (4MB)" ,63,size64K, 8,size8K, 0,0, 0,0 },
{ 0x0001, 0x2200, size4MB, CMD_TYPE_AMD, "AMD 29lv320MB 2Mx16 BotB (4MB)" ,8,size8K, 63,size64K, 0,0, 0,0 },
{ 0x0001, 0x227E, size4MB, CMD_TYPE_AMD, "AMD 29lv320MT 2Mx16 TopB (4MB)" ,63,size64K, 8,size8K, 0,0, 0,0 },
{ 0x0001, 0x2201, size4MB, CMD_TYPE_AMD, "AMD 29lv320MT 2Mx16 TopB (4MB)" ,63,size64K, 8,size8K, 0,0, 0,0 },
{ 0x0089, 0x0018,size16MB, CMD_TYPE_SCS, "Intel 28F128J3 8Mx16 (16MB)" ,128,size128K, 0,0, 0,0, 0,0 },
{ 0x0089, 0x8891, size2MB, CMD_TYPE_BSC, "Intel 28F160B3 1Mx16 BotB (2MB)" ,8,size8K, 31,size64K, 0,0, 0,0 },
{ 0x0089, 0x8890, size2MB, CMD_TYPE_BSC, "Intel 28F160B3 1Mx16 TopB (2MB)" ,31,size64K, 8,size8K, 0,0, 0,0 },
{ 0x0089, 0x88C3, size2MB, CMD_TYPE_BSC, "Intel 28F160C3 1Mx16 BotB (2MB)" ,8,size8K, 31,size64K, 0,0, 0,0 },
{ 0x0089, 0x88C2, size2MB, CMD_TYPE_BSC, "Intel 28F160C3 1Mx16 TopB (2MB)" ,31,size64K, 8,size8K, 0,0, 0,0 },
{ 0x00b0, 0x00d0, size2MB, CMD_TYPE_SCS, "Intel 28F160S3/5 1Mx16 (2MB)" ,32,size64K, 0,0, 0,0, 0,0 },
{ 0x0089, 0x8897, size4MB, CMD_TYPE_BSC, "Intel 28F320B3 2Mx16 BotB (4MB)" ,8,size8K, 63,size64K, 0,0, 0,0 },
{ 0x0089, 0x8896, size4MB, CMD_TYPE_BSC, "Intel 28F320B3 2Mx16 TopB (4MB)" ,63,size64K, 8,size8K, 0,0, 0,0 },
{ 0x0089, 0x88C5, size4MB, CMD_TYPE_BSC, "Intel 28F320C3 2Mx16 BotB (4MB)" ,8,size8K, 63,size64K, 0,0, 0,0 },
{ 0x0089, 0x88C4, size4MB, CMD_TYPE_BSC, "Intel 28F320C3 2Mx16 TopB (4MB)" ,63,size64K, 8,size8K, 0,0, 0,0 },
{ 0x0089, 0x0016, size4MB, CMD_TYPE_SCS, "Intel 28F320J3 2Mx16 (4MB)" ,32,size128K, 0,0, 0,0, 0,0 },
{ 0x0089, 0x0014, size4MB, CMD_TYPE_SCS, "Intel 28F320J5 2Mx16 (4MB)" ,32,size128K, 0,0, 0,0, 0,0 },
{ 0x00b0, 0x00d4, size4MB, CMD_TYPE_SCS, "Intel 28F320S3/5 2Mx16 (4MB)" ,64,size64K, 0,0, 0,0, 0,0 },
{ 0x0089, 0x8899, size8MB, CMD_TYPE_BSC, "Intel 28F640B3 4Mx16 BotB (8MB)" ,8,size8K, 127,size64K, 0,0, 0,0 },
{ 0x0089, 0x8898, size8MB, CMD_TYPE_BSC, "Intel 28F640B3 4Mx16 TopB (8MB)" ,127,size64K, 8,size8K, 0,0, 0,0 },
{ 0x0089, 0x88CD, size8MB, CMD_TYPE_BSC, "Intel 28F640C3 4Mx16 BotB (8MB)" ,8,size8K, 127,size64K, 0,0, 0,0 },
{ 0x0089, 0x88CC, size8MB, CMD_TYPE_BSC, "Intel 28F640C3 4Mx16 TopB (8MB)" ,127,size64K, 8,size8K, 0,0, 0,0 },
{ 0x0089, 0x0017, size8MB, CMD_TYPE_SCS, "Intel 28F640J3 4Mx16 (8MB)" ,64,size128K, 0,0, 0,0, 0,0 },
{ 0x0089, 0x0015, size8MB, CMD_TYPE_SCS, "Intel 28F640J5 4Mx16 (8MB)" ,64,size128K, 0,0, 0,0, 0,0 },
{ 0x0004, 0x22F9, size4MB, CMD_TYPE_AMD, "MBM29LV320BE 2Mx16 BotB (4MB)" ,1,size16K, 2,size8K, 1,size32K, 63,size64K },
{ 0x0004, 0x22F6, size4MB, CMD_TYPE_AMD, "MBM29LV320TE 2Mx16 TopB (4MB)" ,63,size64K, 1,size32K, 2,size8K, 1,size16K },
// --- These definitions were defined based off the flash.h in GPL source from Linksys, but appear incorrect ---
// { 0x00C2, 0x22A8, size4MB, CMD_TYPE_AMD, "MX29LV320B 2Mx16 BotB (4MB)" ,1,size16K, 2,size8K, 1,size32K, 63,size64K },
// { 0x00C2, 0x00A8, size4MB, CMD_TYPE_AMD, "MX29LV320B 2Mx16 BotB (4MB)" ,1,size16K, 2,size8K, 1,size32K, 63,size64K },
// { 0x00C2, 0x00A7, size4MB, CMD_TYPE_AMD, "MX29LV320T 2Mx16 TopB (4MB)" ,63,size64K, 1,size32K, 2,size8K, 1,size16K },
// { 0x00C2, 0x22A7, size4MB, CMD_TYPE_AMD, "MX29LV320T 2Mx16 TopB (4MB)" ,63,size64K, 1,size32K, 2,size8K, 1,size16K },
// --- These below are proper however ---
{ 0x00C2, 0x22A8, size4MB, CMD_TYPE_AMD, "MX29LV320B 2Mx16 BotB (4MB)" ,8,size8K, 63,size64K, 0,0, 0,0 },
{ 0x00C2, 0x00A8, size4MB, CMD_TYPE_AMD, "MX29LV320B 2Mx16 BotB (4MB)" ,8,size8K, 63,size64K, 0,0, 0,0 },
{ 0x00C2, 0x00A7, size4MB, CMD_TYPE_AMD, "MX29LV320T 2Mx16 TopB (4MB)" ,63,size64K, 8,size8K, 0,0, 0,0 },
{ 0x00C2, 0x22A7, size4MB, CMD_TYPE_AMD, "MX29LV320T 2Mx16 TopB (4MB)" ,63,size64K, 8,size8K, 0,0, 0,0 },
//--- End of Changes ----
{ 0x00BF, 0x2783, size4MB, CMD_TYPE_SST, "SST39VF320 2Mx16 (4MB)" ,64,size64K, 0,0, 0,0, 0,0 },
{ 0x0020, 0x22CB, size4MB, CMD_TYPE_AMD, "ST 29w320DB 2Mx16 BotB (4MB)" ,1,size16K, 2,size8K, 1,size32K, 63,size64K },
{ 0x0020, 0x22CA, size4MB, CMD_TYPE_AMD, "ST 29w320DT 2Mx16 TopB (4MB)" ,63,size64K, 1,size32K, 2,size8K, 1,size16K },
{ 0x00b0, 0x00e3, size4MB, CMD_TYPE_BSC, "Sharp 28F320BJE 2Mx16 BotB (4MB)" ,8,size8K, 63,size64K, 0,0, 0,0 },
{ 0x0098, 0x009C, size4MB, CMD_TYPE_AMD, "TC58FVB321 2Mx16 BotB (4MB)" ,1,size16K, 2,size8K, 1,size32K, 63,size64K },
{ 0x0098, 0x009A, size4MB, CMD_TYPE_AMD, "TC58FVT321 2Mx16 TopB (4MB)" ,63,size64K, 1,size32K, 2,size8K, 1,size16K },
// --- Add a few new Flash Chip Definitions ---
{ 0x001F, 0x00C0, size4MB, CMD_TYPE_AMD, "AT49BV/LV16X 2Mx16 BotB (4MB)" ,8,size8K, 63,size64K, 0,0, 0,0 },
{ 0x001F, 0x00C2, size4MB, CMD_TYPE_AMD, "AT49BV/LV16XT 2Mx16 TopB (4MB)" ,63,size64K, 8,size8K, 0,0, 0,0 },
{ 0x0004, 0x2249, size2MB, CMD_TYPE_AMD, "MBM29LV160B 1Mx16 BotB (2MB)" ,1,size16K, 2,size8K, 1,size32K, 31,size64K },
{ 0x0004, 0x22c4, size2MB, CMD_TYPE_AMD, "MBM29LV160T 1Mx16 TopB (2MB)" ,31,size64K, 1,size32K, 2,size8K, 1,size16K },
{ 0x00C2, 0x2249, size2MB, CMD_TYPE_AMD, "MX29LV161B 1Mx16 BotB (2MB)" ,1,size16K, 2,size8K, 1,size32K, 31,size64K },
{ 0x00C2, 0x22c4, size2MB, CMD_TYPE_AMD, "MX29LV161T 1Mx16 TopB (2MB)" ,31,size64K, 1,size32K, 2,size8K, 1,size16K },
{ 0x0020, 0x2249, size2MB, CMD_TYPE_AMD, "ST M29W160EB 1Mx16 BotB (2MB)" ,1,size16K, 2,size8K, 1,size32K, 31,size64K },
{ 0x0020, 0x22c4, size2MB, CMD_TYPE_AMD, "ST M29W160ET 1Mx16 TopB (2MB)" ,31,size64K, 1,size32K, 2,size8K, 1,size16K },
// --- Add a few new Flash Chip Definitions ---
{ 0x00BF, 0x234B, size4MB, CMD_TYPE_SST, "SST39VF1601 1Mx16 BotB (2MB)" ,64,size32K, 0,0, 0,0, 0,0 },
{ 0x00BF, 0x234A, size4MB, CMD_TYPE_SST, "SST39VF1602 1Mx16 TopB (2MB)" ,64,size32K, 0,0, 0,0, 0,0 },
{ 0x00BF, 0x235B, size4MB, CMD_TYPE_SST, "SST39VF3201 2Mx16 BotB (4MB)" ,128,size32K, 0,0, 0,0, 0,0 },
{ 0x00BF, 0x235A, size4MB, CMD_TYPE_SST, "SST39VF3202 2Mx16 TopB (4MB)" ,128,size32K, 0,0, 0,0, 0,0 },
{ 0x00BF, 0x236B, size4MB, CMD_TYPE_SST, "SST39VF6401 4Mx16 BotB (8MB)" ,256,size32K, 0,0, 0,0, 0,0 },
{ 0x00BF, 0x236A, size4MB, CMD_TYPE_SST, "SST39VF6402 4Mx16 TopB (8MB)" ,256,size32K, 0,0, 0,0, 0,0 },
// --- Add a few new Flash Chip Definitions ---
{ 0x00EC, 0x2275, size2MB, CMD_TYPE_AMD, "K8D1716UTC 1Mx16 TopB (2MB)" ,31,size64K, 8,size8K, 0,0, 0,0 },
{ 0x00EC, 0x2277, size2MB, CMD_TYPE_AMD, "K8D1716UBC 1Mx16 BotB (2MB)" ,8,size8K, 31,size64K, 0,0, 0,0 },
// --- Add a few new Flash Chip Definitions ---
{ 0x00C2, 0x22DA, size1MB, CMD_TYPE_AMD, "MX29LV800BTC 512kx16 TopB (1MB)" ,15,size32K, 1,size16K, 2,size4K, 1,size8K },
{ 0x00C2, 0x225B, size1MB, CMD_TYPE_AMD, "MX29LV800BTC 512kx16 BotB (1MB)" ,1,size8K, 2,size4K, 1,size16K, 15,size32K },
// --- Add a few new Flash Chip Definitions ---
{ 0x00EC, 0x22A0, size2MB, CMD_TYPE_AMD, "K8D3216UTC 2Mx16 TopB (4MB)" ,63,size64K, 8,size8K, 0,0, 0,0 },
{ 0x00EC, 0x22A2, size2MB, CMD_TYPE_AMD, "K8D3216UBC 2Mx16 BotB (4MB)" ,8,size8K, 63,size64K, 0,0, 0,0 },
// --- Add a few new Flash Chip Definitions ---
{ 0x00BF, 0x236D, size4MB, CMD_TYPE_SST, "SST39VF6401B 4Mx16 BotB (8MB)" ,256,size32K, 0,0, 0,0, 0,0 },
{ 0x00BF, 0x236C, size4MB, CMD_TYPE_SST, "SST39VF6402B 4Mx16 TopB (8MB)" ,256,size32K, 0,0, 0,0, 0,0 },
{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
};
// -----------------------------------------
// ---- Start of Compiler Specific Code ----
// -----------------------------------------
void lpt_openport(void)
{
#ifdef WINDOWS_VERSION // ---- Compiler Specific Code ----
HANDLE h;
h = CreateFile("\\\\.\\giveio", GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if(h == INVALID_HANDLE_VALUE) { printf("Couldn't access giveio device\n"); CloseHandle(h); exit(0); }
CloseHandle(h);
#else // ---- Compiler Specific Code ----
#ifdef __FreeBSD__ // ---- Compiler Specific Code ----
pfd = open("/dev/ppi0", O_RDWR);
if (pfd < 0) { perror("Failed to open /dev/ppi0"); exit(0); }
if ((ioctl(pfd, PPEXCL) < 0) || (ioctl(pfd, PPCLAIM) < 0)) { perror("Failed to lock /dev/ppi0"); close(pfd); exit(0); }
#else // ---- Compiler Specific Code ----
pfd = open("/dev/parport0", O_RDWR);
if (pfd < 0) { perror("Failed to open /dev/parport0"); exit(0); }
if ((ioctl(pfd, PPEXCL) < 0) || (ioctl(pfd, PPCLAIM) < 0)) { perror("Failed to lock /dev/parport0"); close(pfd); exit(0); }
#endif
#endif
}
void lpt_closeport(void)
{
#ifndef WINDOWS_VERSION // ---- Compiler Specific Code ----
#ifndef __FreeBSD__ // ---- Compiler Specific Code ----
if (ioctl(pfd, PPRELEASE) < 0) { perror("Failed to release /dev/parport0"); close(pfd); exit(0); }
#endif
close(pfd);
#endif
}
static unsigned char clockin(int tms, int tdi)
{
unsigned char data;
tms = tms ? 1 : 0;
tdi = tdi ? 1 : 0;
if(wiggler) data = (1 << WTDO) | (0 << WTCK) | (tms << WTMS) | (tdi << WTDI) | (1 << WTRST_N);
else data = (1 << TDO) | (0 << TCK) | (tms << TMS) | (tdi << TDI);
#ifdef WINDOWS_VERSION // ---- Compiler Specific Code ----
_outp(0x378, data);
#else
ioctl(pfd, PPWDATA, &data);
#endif
if(wiggler) data = (1 << WTDO) | (1 << WTCK) | (tms << WTMS) | (tdi << WTDI) | (1 << WTRST_N);
else data = (1 << TDO) | (1 << TCK) | (tms << TMS) | (tdi << TDI);
#ifdef WINDOWS_VERSION // ---- Compiler Specific Code ----
_outp(0x378, data);
#else
ioctl(pfd, PPWDATA, &data);
#endif
#ifdef WINDOWS_VERSION // ---- Compiler Specific Code ----
data = (unsigned char)_inp(0x379);
#else
ioctl(pfd, PPRSTATUS, &data);
#endif
data ^= 0x80;
data >>= TDO;
data &= 1;
return data;
}
// ---------------------------------------
// ---- End of Compiler Specific Code ----
// ---------------------------------------
void test_reset(void)
{
clockin(1, 0); // Run through a handful of clock cycles with TMS high to make sure
clockin(1, 0); // we are in the TEST-LOGIC-RESET state.
clockin(1, 0);
clockin(1, 0);
clockin(1, 0);
clockin(0, 0); // enter runtest-idle
}
void set_instr(int instr)
{
int i;
static int curinstr = 0xFFFFFFFF;
if (instr == curinstr)
return;
clockin(1, 0); // enter select-dr-scan
clockin(1, 0); // enter select-ir-scan
clockin(0, 0); // enter capture-ir
clockin(0, 0); // enter shift-ir (dummy)
for (i=0; i < instruction_length; i++)
{
clockin(i==(instruction_length - 1), (instr>>i)&1);
}
clockin(1, 0); // enter update-ir
clockin(0, 0); // enter runtest-idle
curinstr = instr;
}
static unsigned int ReadWriteData(unsigned int in_data)
{
int i;
unsigned int out_data = 0;
unsigned char out_bit;
clockin(1, 0); // enter select-dr-scan
clockin(0, 0); // enter capture-dr
clockin(0, 0); // enter shift-dr
for(i = 0 ; i < 32 ; i++)
{
out_bit = clockin((i == 31), ((in_data >> i) & 1));
out_data = out_data | (out_bit << i);
}
clockin(1,0); // enter update-dr
clockin(0,0); // enter runtest-idle
return out_data;
}
static unsigned int ReadData(void)
{
return ReadWriteData(0x00);
}
void WriteData(unsigned int in_data)
{
ReadWriteData(in_data);
}
void ShowData(unsigned int value)
{
int i;
for (i=0; i<32; i++)
printf("%d", (value >> (31-i)) & 1);
printf(" (%08X)\n", value);
}
static unsigned int ejtag_read(unsigned int addr)
{
if (USE_DMA) return(ejtag_dma_read(addr));
else return(ejtag_pracc_read(addr));
}
static unsigned int ejtag_read_h(unsigned int addr)
{
if (USE_DMA) return(ejtag_dma_read_h(addr));
else return(ejtag_pracc_read_h(addr));
}
void ejtag_write(unsigned int addr, unsigned int data)
{
if (USE_DMA) ejtag_dma_write(addr, data);
else ejtag_pracc_write(addr, data);
}
void ejtag_write_h(unsigned int addr, unsigned int data)
{
if (USE_DMA) ejtag_dma_write_h(addr, data);
else ejtag_pracc_write_h(addr, data);
}
static unsigned int ejtag_dma_read(unsigned int addr)
{
unsigned int data;
int retries = RETRY_ATTEMPTS;
begin_ejtag_dma_read:
// Setup Address
set_instr(INSTR_ADDRESS);
WriteData(addr);
// Initiate DMA Read & set DSTRT
set_instr(INSTR_CONTROL);
ctrl_reg = ReadWriteData(DMAACC | DRWN | DMA_WORD | DSTRT | PROBEN | PRACC);
// Wait for DSTRT to Clear
while (ReadWriteData(DMAACC | PROBEN | PRACC) & DSTRT);
// Read Data
set_instr(INSTR_DATA);
data = ReadData();
// Clear DMA & Check DERR
set_instr(INSTR_CONTROL);
if (ReadWriteData(PROBEN | PRACC) & DERR)
{
if (retries--) goto begin_ejtag_dma_read;
else printf("DMA Read Addr = %08x Data = (%08x)ERROR ON READ\n", addr, data);
}
return(data);
}
static unsigned int ejtag_dma_read_h(unsigned int addr)
{
unsigned int data;
int retries = RETRY_ATTEMPTS;
begin_ejtag_dma_read_h:
// Setup Address
set_instr(INSTR_ADDRESS);
WriteData(addr);
// Initiate DMA Read & set DSTRT
set_instr(INSTR_CONTROL);
ctrl_reg = ReadWriteData(DMAACC | DRWN | DMA_HALFWORD | DSTRT | PROBEN | PRACC);
// Wait for DSTRT to Clear
while (ReadWriteData(DMAACC | PROBEN | PRACC) & DSTRT);
// Read Data
set_instr(INSTR_DATA);
data = ReadData();
// Clear DMA & Check DERR
set_instr(INSTR_CONTROL);
if (ReadWriteData(PROBEN | PRACC) & DERR)
{
if (retries--) goto begin_ejtag_dma_read_h;
else printf("DMA Read Addr = %08x Data = (%08x)ERROR ON READ\n", addr, data);
}
// Handle the bigendian/littleendian
if ( addr & 0x2 ) data = (data>>16)&0xffff ;
else data = (data&0x0000ffff) ;
return(data);
}
void ejtag_dma_write(unsigned int addr, unsigned int data)
{
int retries = RETRY_ATTEMPTS;
begin_ejtag_dma_write:
// Setup Address
set_instr(INSTR_ADDRESS);
WriteData(addr);
// Setup Data
set_instr(INSTR_DATA);
WriteData(data);
// Initiate DMA Write & set DSTRT
set_instr(INSTR_CONTROL);
ctrl_reg = ReadWriteData(DMAACC | DMA_WORD | DSTRT | PROBEN | PRACC);
// Wait for DSTRT to Clear
while (ReadWriteData(DMAACC | PROBEN | PRACC) & DSTRT);
// Clear DMA & Check DERR
set_instr(INSTR_CONTROL);
if (ReadWriteData(PROBEN | PRACC) & DERR)
{
if (retries--) goto begin_ejtag_dma_write;
else printf("DMA Write Addr = %08x Data = ERROR ON WRITE\n", addr);
}
}
void ejtag_dma_write_h(unsigned int addr, unsigned int data)
{
int retries = RETRY_ATTEMPTS;
begin_ejtag_dma_write_h:
// Setup Address
set_instr(INSTR_ADDRESS);
WriteData(addr);
// Setup Data
set_instr(INSTR_DATA);
WriteData(data);
// Initiate DMA Write & set DSTRT
set_instr(INSTR_CONTROL);
ctrl_reg = ReadWriteData(DMAACC | DMA_HALFWORD | DSTRT | PROBEN | PRACC);
// Wait for DSTRT to Clear
while (ReadWriteData(DMAACC | PROBEN | PRACC) & DSTRT);
// Clear DMA & Check DERR
set_instr(INSTR_CONTROL);
if (ReadWriteData(PROBEN | PRACC) & DERR)
{
if (retries--) goto begin_ejtag_dma_write_h;
else printf("DMA Write Addr = %08x Data = ERROR ON WRITE\n", addr);
}
}
static unsigned int ejtag_pracc_read(unsigned int addr)
{
address_register = addr | 0xA0000000; // Force to use uncached segment
data_register = 0x0;
ExecuteDebugModule(pracc_readword_code_module);
return(data_register);
}
void ejtag_pracc_write(unsigned int addr, unsigned int data)
{
address_register = addr | 0xA0000000; // Force to use uncached segment
data_register = data;
ExecuteDebugModule(pracc_writeword_code_module);
}
static unsigned int ejtag_pracc_read_h(unsigned int addr)
{
address_register = addr | 0xA0000000; // Force to use uncached segment
data_register = 0x0;
ExecuteDebugModule(pracc_readhalf_code_module);
return(data_register);
}
void ejtag_pracc_write_h(unsigned int addr, unsigned int data)
{
address_register = addr | 0xA0000000; // Force to use uncached segment
data_register = data;
ExecuteDebugModule(pracc_writehalf_code_module);
}
void ExecuteDebugModule(unsigned int *pmodule)
{
unsigned int ctrl_reg;
unsigned int address;
unsigned int data = 0;
unsigned int offset = 0;
int finished = 0;
int DEBUGMSG = 0;
if (DEBUGMSG) printf("DEBUGMODULE: Start module.\n");
// Feed the chip an array of 32 bit values into the processor via the EJTAG port as instructions.
while (1)
{
// Read the control register. Make sure an access is requested, then do it.
while(1)
{
set_instr(INSTR_CONTROL);
ctrl_reg = ReadWriteData(PRACC | PROBEN | SETDEV);
if (ctrl_reg & PRACC)
break;
if (DEBUGMSG) printf("DEBUGMODULE: No memory access in progress!\n");
}
set_instr(INSTR_ADDRESS);
address = ReadData();
// Check for read or write
if (ctrl_reg & PRNW) // Bit set for a WRITE
{
// Read the data out
set_instr(INSTR_DATA);
data = ReadData();
// Clear the access pending bit (let the processor eat!)
set_instr(INSTR_CONTROL);
ctrl_reg = ReadWriteData(PROBEN | SETDEV);
// Processor is writing to us
if (DEBUGMSG) printf("DEBUGMODULE: Write 0x%08X to address 0x%08X\n", data, address);
// Handle Debug Write
// If processor is writing to one of our psuedo virtual registers then save off data
if (address == MIPS_VIRTUAL_ADDRESS_ACCESS) address_register = data;
if (address == MIPS_VIRTUAL_DATA_ACCESS) data_register = data;
}
else
{
// Check to see if its reading at the debug vector. The first pass through
// the module is always read at the vector, so the first one we allow. When
// the second read from the vector occurs we are done and just exit.
if (address == MIPS_DEBUG_VECTOR_ADDRESS)
{
if (finished++) // Allows ONE pass
{
if (DEBUGMSG) printf("DEBUGMODULE: Finished module.\n");
return;
}
}
// Processor is reading from us
if (address >= MIPS_DEBUG_VECTOR_ADDRESS)
{
// Reading an instruction from our module so fetch the instruction from the module
offset = (address - MIPS_DEBUG_VECTOR_ADDRESS) / 4;
data = *(unsigned int *)(pmodule + offset);
if (DEBUGMSG) printf("DEBUGMODULE: Instruction read at 0x%08X offset -> %04d data -> 0x%08X\n", address, offset, data); //fflush(stdout);
}
else
{
// Reading from our virtual register area
if (DEBUGMSG) printf("DEBUGMODULE: Read address 0x%08X data = 0x%08X\n", address, data);
// Handle Debug Read
// If processor is reading from one of our psuedo virtual registers then give it data
if (address == MIPS_VIRTUAL_ADDRESS_ACCESS) data = address_register;
if (address == MIPS_VIRTUAL_DATA_ACCESS) data = data_register;
}
// Send the data out
set_instr(INSTR_DATA);
data = ReadWriteData(data);
// Clear the access pending bit (let the processor eat!)
set_instr(INSTR_CONTROL);
ctrl_reg = ReadWriteData(PROBEN | SETDEV);
}
}
}
void chip_detect(void)
{
unsigned int id = 0x0;
processor_chip_type* processor_chip = processor_chip_list;
lpt_openport();
printf("Probing bus ... ");
if (skipdetect)
{
// Manual Override CPU Chip ID
test_reset();
instruction_length = instrlen;
set_instr(INSTR_IDCODE);
id = ReadData();
printf("Done\n\n");
printf("Instruction Length set to %d\n\n",instruction_length);
printf("CPU Chip ID: "); ShowData(id); printf("*** CHIP DETECTION OVERRIDDEN ***\n\n");
return;
}
else
{
// Auto Detect CPU Chip ID
while (processor_chip->chip_id)
{
test_reset();
if (instrlen)
instruction_length = instrlen;
else
instruction_length = processor_chip->instr_length;
set_instr(INSTR_IDCODE);
id = ReadData();
if (id == processor_chip->chip_id)
{
printf("Done\n\n");
printf("Instruction Length set to %d\n\n",instruction_length);
printf("CPU Chip ID: "); ShowData(id); printf("*** Found a %s chip ***\n\n", processor_chip->chip_descr);
return;
}
processor_chip++;
}
}
printf("Done\n\n");
printf("Instruction Length set to %d\n\n",instruction_length);
printf("CPU Chip ID: "); ShowData(id); printf("*** Unknown or NO CPU Chip ID Detected ***\n\n");
printf("*** Possible Causes:\n");
printf(" 1) WRT54G/GS is not Connected.\n");
printf(" 2) WRT54G/GS is not Powered On.\n");
printf(" 3) Improper JTAG Cable.\n");
printf(" 4) Unrecognized CPU Chip ID.\n");
chip_shutdown();;
exit(0);
}
void check_ejtag_features()
{
unsigned int features;
set_instr(INSTR_IMPCODE);
features = ReadData();
printf(" - EJTAG IMPCODE ....... : "); ShowData(features);
// EJTAG Version
ejtag_version = (features >> 29) & 7;
printf(" - EJTAG Version ....... : ");
if (ejtag_version == 0) printf("1 or 2.0\n");
else if (ejtag_version == 1) printf("2.5\n");
else if (ejtag_version == 2) printf("2.6\n");
else printf("Unknown (%d is a reserved value)\n", ejtag_version);
// EJTAG DMA Support
USE_DMA = !(features & (1 << 14));
printf(" - EJTAG DMA Support ... : %s\n", USE_DMA ? "Yes" : "No");
if (force_dma) { USE_DMA = 1; printf(" *** DMA Mode Forced On ***\n"); }
if (force_nodma) { USE_DMA = 0; printf(" *** DMA Mode Forced Off ***\n"); }
printf("\n");
}
void chip_shutdown(void)
{
fflush(stdout);
test_reset();
lpt_closeport();
}
void run_backup(char *filename, unsigned int start, unsigned int length)
{
unsigned int addr, data;
FILE *fd;
int counter = 0;
int percent_complete = 0;
char newfilename[128] = "";
time_t start_time = time(0);
time_t end_time, elapsed_seconds;
struct tm* lt = localtime(&start_time);
char time_str[15];
sprintf(time_str, "%04d%02d%02d_%02d%02d%02d",
lt->tm_year + 1900, lt->tm_mon + 1, lt->tm_mday,
lt->tm_hour, lt->tm_min, lt->tm_sec
);
printf("*** You Selected to Backup the %s ***\n\n",filename);
strcpy(newfilename,filename);
strcat(newfilename,".SAVED");
if (issue_timestamp)
{
strcat(newfilename,"_");
strcat(newfilename,time_str);
}
fd = fopen(newfilename, "wb" );
if (fd<=0)
{
fprintf(stderr,"Could not open %s for writing\n", newfilename);
exit(1);
}
printf("=========================\n");
printf("Backup Routine Started\n");
printf("=========================\n");
printf("\nSaving %s to Disk...\n",newfilename);
for(addr=start; addr<(start+length); addr+=4)
{
counter += 4;
percent_complete = (counter * 100 / length);
if (!silent_mode)
if ((addr&0xF) == 0) printf("[%3d%% Backed Up] %08x: ", percent_complete, addr);
data = ejtag_read(addr);
fwrite( (unsigned char*) &data, 1, sizeof(data), fd);
if (silent_mode) printf("%4d%% bytes = %d\r", percent_complete, counter);
else printf("%08x%c", data, (addr&0xF)==0xC?'\n':' ');
fflush(stdout);
}
fclose(fd);
printf("Done (%s saved to Disk OK)\n\n",newfilename);
printf("bytes written: %d\n", counter);
printf("=========================\n");
printf("Backup Routine Complete\n");
printf("=========================\n");
time(&end_time);
elapsed_seconds = difftime(end_time, start_time);
printf("elapsed time: %d seconds\n", (int)elapsed_seconds);
}
void run_flash(char *filename, unsigned int start, unsigned int length)
{
unsigned int addr, data ;
FILE *fd ;
int counter = 0;
int percent_complete = 0;
time_t start_time = time(0);
time_t end_time, elapsed_seconds;