summaryrefslogtreecommitdiff
path: root/utils
AgeCommit message (Collapse)Author
2017-09-19upgtools: fix bug in brute force searchAmaury Pouly
DES ignores the parity bit of each byte (making the 64-bit key really 56-bit), but the current code skipped the parity bit of each half-byte, thus missing some keys. Change-Id: Ia523ebb944e458905b7de1742df151df22166150
2017-09-17Add support for the NWZ-E350Amaury Pouly
Strangely it has the SAME encryption key as the E450. Either they didn't bother changing it or more likely they have exactly the same internals and a slightly different case. Change-Id: I39ab88845b3e40db34160c2e61dde421f391df44
2017-09-15ATJ hwstub: Add cache coherencyMarcin Bukat
All the hard work was done by pamaury. I simply added proper defines. Change-Id: Ib374eea7cd20f35518ad8a68d771c57c54ae01ca
2017-09-06qeditor: add workaround for c++11 in qt4, suggest to use qt5Amaury Pouly
Change-Id: Iad7b8fd171d57228796a68cb3406914213b91926
2017-09-05Initial commit for the Sony NWZ linux portAmaury Pouly
SUPPORTED SERIES: - NWZ-E450 - NWZ-E460 - NWZ-E470 - NWZ-E580 - NWZ-A10 NOTES: - bootloader makefile convert an extra font to be installed alongside the bootloader since sysfont is way too small - the toolsicon bitmap comes from the Oxygen iconset - touchscreen driver is untested TODO: - implement audio routing driver (pcm is handled by pcm-alsa) - fix playback: it crashes on illegal instruction in DEBUG builds - find out why the browser starts at / instead of /contents - implement radio support - implement return to OF for usb handling - calibrate battery curve (NB: of can report a battery level on a 0-5 scale but probabl don't want to use that ?) - implement simulator build (we need a nice image of the player) - figure out if we can detect jack removal POTENTIAL TODOS: - try to build a usb serial gadget and gdbserver Change-Id: Ic77d71e0651355d47cc4e423a40fb64a60c69a80
2017-08-28qeditor: fix compile error and some commentsAmaury Pouly
Change-Id: I157c83fea8173adc53254f15aa49e41ee1ba7549
2017-07-30atjboottool: cleanup and add support for atj2127Amaury Pouly
Several people asked me recently how to decrypt atj2127 firmware. Someone posted on github (https://github.com/nfd/atj2127decrypt) a decrypt utility clearly reverse engineered from some unknown source. The code is an absolute horror but I concluded that ATJ changed very little between ATJ213x and ATJ2127 so I added support for the ATJ2127, credit to this github code that I stole and rewrite (code was under MIT licence). At the same time do some small code cleanups. Note that there is not 100% sure way that I know to distinguish between the two firmware types, so the code tries to do an educated guess to detect ATJ2127. If this does not work, use --atj21217 option. Also note that contrary to the github tool that decrypts and unpack in one go, this tool only does one step at once. So first decrypt: HEX -> AFI, then unpack AFI -> files. I also added for a different version of AFI. Based on AFI files I have, there are, I think, two versions: the "old" ones (pre-ATJ213x) and "new" ones. The tool only supported the new one but for some reason the ATJ2127 uses the old ones without a mostly empty header. Strangely, even this mostly empty header does not seem to follow the old layout as reverse engineered by the s1mp3 project (https://sourceforge.net/p/s1mp3/code/HEAD/tree/trunk/s1fwx/heads.h), so in fact there might be three versions. In any case, only the header is different, the rest of the file is identical so at the moment I just don't print any header info for "old" files. Change-Id: I1de61e64f433f6cacd239cd3c1ba469b9bb12442
2017-06-18nwztools/scsitool: add a command to query multiple nvp nodes at onceAmaury Pouly
Change-Id: I89fed904b282a202bc845b08f4c8d1200a49636d
2017-06-18nwztools/scsitool: fix devinfo, add dhpAmaury Pouly
The devinfo request returned the raw data, now the tool prints the various fields. Also add support for the dhp (destination/headphones/color ...): this one is untested because it's only supported starting from A10 or A20. There is still a problem with the dpcc prop: although it should work for DEVINFO, it does not, despite the fact that the get_dev_info command works and is internally (on the Sony) translated into a dpcc request. I keep the code just in case. Change-Id: I5aa8ef4afb0b11d3c0ddfa3d38f3e737ee1aff66
2017-06-18nwztools/scsitool: print error on check senseAmaury Pouly
The detailled error message is only printed if -d switch is on command line, otherwise there is no error message which is wrong so fix that. Change-Id: I397541c467940e9b290ee8d4ae704368b1ce132b
2017-06-13nwztools: add KAS for NW-S10 (brute-forced using upgtool)Amaury Pouly
Change-Id: Ia37818faee29130ffe3690c83f85a39bd35637e0
2017-06-13nwztools: add nvp description for NW-S10 seriesAmaury Pouly
Change-Id: Id6a6e51288f4ff24c0063b6c16b74109211e63c0
2017-06-05Add NW-A36 and NW-A37 model IDs, based on the A30 service manual.Amaury Pouly
I am unsure about the names of the player, the manual says A36HN and A37HN but at the same time there is a A35 and A35HN with the same ID, and Sony does not usually put the "HN" in its device list. Change-Id: Idbf32970aa334b30f1b8947a78b8eebd524b193b
2017-04-25nwztools/database: misc improvementsIgor Skochinsky
* make gen_db.py work on Windows/Python 2 - use hashlib module instead of md5sum, also don't rely on / for file path matching - don't use 'file' for a variable name * fix parse_nvp_header.sh for older kernels pre-emmc kernel sources use a slightly different #define format; adjust regexp to catch it. * add nwz-x1000 series NVP layout (from icx1087_nvp.h) some new tags have no description, alas the driver doesn't have them :/ * minor fixes to nvp/README fixed typos/wording Change-Id: I77d8c2704be2f2316e32aadcfd362df7102360d4
2017-04-25nwztools/upgtools: misc fixesIgor Skochinsky
* added KAS for nwz-x1000 (extracted from an NWZ-X1060 via "get_dnk_nvp kas") * hint that -o is needed when extracting Change-Id: Ic91c448aa058a22c8ddcae54726f628f7cf60f6b
2017-04-25nwztools/upgtools: add key for NWZ-A840Amaury Pouly
Change-Id: I0a191db1970e64b5ced518c68861392ba342404f
2017-04-25nwztools: small cleanupsAmaury Pouly
Change-Id: I4fde020ca0556a84d051f9b5e46f49ee1241266e
2017-04-03scsi: don't make the linux lib depend on a library header fileAmaury Pouly
The code dependend on the sg_lib header being present, remove this dependency so that we only need public headers. Change-Id: I69398453635135deb33e2adf67f15ddb80e4ba16
2017-02-04nwztools/script: fix dump_rootfs.sh to handle ext4Amaury Pouly
Change-Id: I04bd7599a58669df96dfd018a2ab0e3d53e06694
2017-02-04regtools/qeditor: replace deprecated QStyleOptionViewItemV4Amaury Pouly
...by QStyleOptionViewItem. Yes Qt got it right, in 5.7 they deprecated QStyleOptionViewItemV4 and recommend using QStyleOptionViewItem which contains less fields except on newer Qt where it contains all fields. Hopefully it still works on Qt>4.x for a large enough value of x. Change-Id: I013c383d2424b04c1c0745f0d7b1d5e62a29d324
2017-02-04regtools/qeditor: compute RAM sizeAmaury Pouly
Change-Id: I7bfb5cc25bc3dc55f379b2319b20dc9510434de0
2017-02-04regtools/qeditor: enable imx233 analysers for imx233Amaury Pouly
The clock structure is identical, and the EMI are the same. Also fix SSP clock, it was broken on imx233 as well. Change-Id: I25ec66059b00b1a456ef2f02131d225082536c0a
2017-02-04regtools/soc_desc: fix bug in libraryAmaury Pouly
Because a node ref is at root doesn't make it valid, check that soc is valid otherwise we return garbage. Change-Id: I6e5befc959dc670ab39a87484e87af6d90be7726
2017-02-04regtools: add new tool list/find/describe registersAmaury Pouly
Change-Id: I2d93d24bd421e1a2ea6d27b8f7cfd17311e6d458
2017-01-24hwstub: be more quiet about register description loading failureAmaury Pouly
Change-Id: I0edbb838022b71485179edec7361a6c554a1ab11
2017-01-24hwstub: fix memory leak in net backendAmaury Pouly
Change-Id: I98bef5aa0c518e698c42761d02899adde8bc4aca
2017-01-24hwstub/jz4760b: add lua code to probe for ei/di and ext instructionsAmaury Pouly
Add lua code to check whether ei/di and ext instructions are supported. This is unclear since xburst is somewhere between mips32r1 and mips32r2. Details results are below, but in summary: they don't work (ei has no effect, di/ext cause illegal instruction exceptions) > ./hwstub_shell -q -b -e 'require("jz/misc"); JZ.misc.enable_sram()' \ -f lua/xburst.lua -e "XBURST.test_ext_inst(0xb32d0000)" [...] Selecting soc jz4760b. Redirecting HW to hwstub.soc.jz4760b data: d7168acf error: lua/xburst.lua:209: call failed trapped exception in call > ./hwstub_shell -q -b -e 'require("jz/misc"); JZ.misc.enable_sram()' \ -f lua/xburst.lua -e "XBURST.test_ei_di_inst(0xb32d0000)" [...] Selecting soc jz4760b. Redirecting HW to hwstub.soc.jz4760b Testing ei Test SR Enable interrupts with CP0 SR: 0x1 Disable interrupts with CP0 SR: 0x0 Test ei/di Enable interrupts with ei SR: 0x0 Disable interrupts with di error: lua/xburst.lua:244: call failed trapped exception in call Change-Id: I2e162b5dd5e70488bcd8b58f3ca401a3ecab3c4b
2017-01-24hwstub: rewrite exception catchingAmaury Pouly
Since we can catch exceptions like data aborts on read/write, it takes very little to also catch exceptions in calls. When extending this with the catching of illegal instructions, the call instruction now becomes much more robust and also for address and instruction probing. Since we can catch several types of exception, rename set_data_abort_jmp to set_exception_jmp. At the same time, simplify the logic in read/write request handlers. Also fix a bug in ARM jump code: it was using stmia r1, {..., pc} as if pc would get current pc + 8 but this is actually implementation defined on older ARMs (typically pc + 12) and deprecated on newer ARMs, so rewrite the code avoid that. The set_exception_jmp() function now also reports the exception type. Change-Id: Icd0dd52d2456b361b27c4776be09c3d13528ed93
2017-01-24hwstub/jz460b: implement exception recoveryAmaury Pouly
Now that we now that jz4760b implements EBASE, we can use it to rebase exceptions to use a k1seg address, that maps to the physical address of the TCSM0. It requires to enable HAB1 to have this translation. This most the most inefficient way to access tighly coupled memory ever, but it works. Change-Id: I894ca929c9835696102eb2fef44b06e6eaf96d44
2017-01-24hwstub: add tool to dump memory regions (such as ROM, RAM, or peripherals)Amaury Pouly
Although this case be done with hwstub_shell, this is common enough to deserve its own tool. Change-Id: I9253e40850f37257464548a3acefb14ea083841d
2017-01-24hwstub: small fixes to argument processing and usage()Amaury Pouly
Change-Id: I3daa5e0c3fa2e7eab6a3d75b4c8aa66254d72f3c
2017-01-24hwstub/jz4760b: build packtools automatically if neeededAmaury Pouly
Change-Id: I543e405bf75868d0f7509a35e08fe31ed253e0e6
2017-01-24hwstub: add verbose mode to makeAmaury Pouly
Use make V=1 to print all commands Change-Id: I28bd4151178413f10ddab292f1d582a9d019f5ea
2017-01-24hwstub: fix long transfers failing because of control xfer size of libusbAmaury Pouly
libusb limits control transfer sizes to 4k, see diff for details. Change-Id: Id2e638010274009ea641d06e9040a8b9ab9d54a9
2017-01-24hwstub: fix library sending wrong data on long transfersAmaury Pouly
Change-Id: I886b8dc28e306f631389dbed41451eb086fea4fc
2017-01-24hwstub: add Fiio X3II IPL/SPL dumping codeAmaury Pouly
Change-Id: I76f7cffc700e8051d02936c24e8a70a0f8925edf
2017-01-24hwstub: add Shanling M2 IPL/SPL dumping codeAmaury Pouly
Change-Id: I14987d9783dd371f4990a5bcfbfb2d1c0c9be213
2017-01-24hwstub: add various jz stuff and xburst testsAmaury Pouly
The JZ misc allows to enable and test SRAM. The XBurst code uses the coprocessor interface to analyse the cpu. It also provides a test platform for various features like EBASE and exceptions. I was able to test and confirm that on jz4760b (thus xburst), EBASE works (but top 2 bits are not controllable and always 01). The processor claims to support vector interrupts but this is untested. The values in ConfigX are not to be trusted blindly, clearly some are wrong. I tried to use the JZ4780 Config7 "ebase gate" to change bit 30 of EBASE but it does not work, which suggests that JZ480 uses a newer version of XBurst. Detailled log below: > ./hwstub_shell -q -f lua/xburst.lua -e "XBURST.init()" [...] XBurst: PRId: 0x2ed0024f CPU: JZ4760(B) Config: 0x80000483 Architecture Type: MIPS32 Architecture Level: Release 2 (or more) MMU Type: Standard TLB Config1: 0x3e63318a MMU Size: 32 ICache Sets per way: 128 Ways: 4 Line size: 32 DCache Sets per way: 128 Ways: 4 Line size: 32 FPU: no Config2: 0x80000000 Config3: 0x20 Vectored interrupt: yes Config7: 0x0 > ./hwstub_shell -q -e 'require("jz/misc"); JZ.misc.enable_sram()' \ -f lua/xburst.lua -e "XBURST.test_ebase(0x80000000);XBURST.test_ebase(0xb32d0000) [...] Testing EBASE... Disable BEV SR value: 0x2000fc00 EBASE value: 0x80000000 Value after writing 0x80000000: 0x80000000 Value after writing 0x80040000: 0x80040000 Test result: EBase seems to work Disable config7 gate: write 0x0 to Config7 Value after writing 0xfffff000: 0xbffff000 Enable config7 gate: write 0x80 to Config7 Value after writing 0xc0000000: 0x80000000 Config7 result: Config7 gate does not work Exception test with EBASE at 0x80000000... Writing instructions to memory Old SR: 0x2000fc00 New SR: 0xfc00 EBASE: 80000000 Before: cafebabe After: deadbeef Exception result: Exception and EBASE are working Testing EBASE... Disable BEV SR value: 0x2000fc00 EBASE value: 0x80000000 Value after writing 0x80000000: 0x80000000 Value after writing 0x80040000: 0x80040000 Test result: EBase seems to work Disable config7 gate: write 0x0 to Config7 Value after writing 0xfffff000: 0xbffff000 Enable config7 gate: write 0x80 to Config7 Value after writing 0xc0000000: 0x80000000 Config7 result: Config7 gate does not work Exception test with EBASE at 0xb32d0000... Writing instructions to memory Old SR: 0x2000fc00 New SR: 0xfc00 EBASE: b32d0000 Before: cafebabe After: deadbeef Exception result: Exception and EBASE are working Change-Id: I894227981a141a8c14419b36ed9f519baf145ad1
2017-01-24hwstub: fix bug in jz4760B boot rom backend probeAmaury Pouly
Change-Id: Idb2b3b3903d88c8f6b494d5c9f04778daf3aaed0
2017-01-24hwstub: add support for coprocessor operationsAmaury Pouly
At the moment the stub only implement them for MIPS. Change-Id: Ica835a0e9c70fa5675c3d655eae986e812a47de8
2017-01-24jz4760b/regtools: fix/rename some register fields, add clock analyzer to qeditorAmaury Pouly
Change-Id: I196414d6e4fc18c00b77903e334b7e6adfb7debc
2017-01-24headergen_v2: add two new macros to write a raw write to set/clr variantsAmaury Pouly
These macros are like jz_setf but instead of writing fields, they write a raw value directly: jz_set(REG, value) and jz_clr(REG, value). Change-Id: I660f20dd691b26d367533877875fc3226a26c992
2017-01-24hwstub: implement EXEC command over netAmaury Pouly
Apparently I completely forgot to implement it so using hwstub over net would just fail all EXEC commands :-s Change-Id: I0d0506cbbce9b86c9a4f19036dacc922d1e51338
2017-01-24hwstub: add the possibility to flush caches before execAmaury Pouly
This is needed on the jz4760b because if some data is loaded to DRAM, then it is cached and a disaster lurks if dcaches/icache are not flushed. Targets that needs this must define CONFIG_FLUSH_CACHES in target-config.h and implement target_flush_caches(). Currently MIPS has some generic code for mips32r1 that requires to define {D,I}CACHE_SIZE and {D,I}CACHE_LINE_SIZE in target-config.h Change-Id: I5a3fc085de9445d8c8a2eb61ae4e2dc9bb6b4e8e
2017-01-24jz4760b_tools: improve usbboot toolAmaury Pouly
Change-Id: I21b61a3f56d718bef3aa0cf5096359c463c1f93a
2017-01-24hwstub/jz4760b: fix some typos in lua script after register name changesAmaury Pouly
Change-Id: Ie46ec293fcd5a16143818e77cd6c79cc08620fb5
2017-01-24hwstub: add jz4760b stubAmaury Pouly
The stub is quite versatile: it can be loaded using bootrom or another other means (like factory boot on Fiio X1). It relocates itself to TCSM0 and provides basic functionality (it does not recover from failed read/writes at the moment). Change-Id: Ib646a4b43fba9358d6f93f0f73a5c2e9bcd775a7
2017-01-24update jz4760b register descAmaury Pouly
Change-Id: Id0a071528eca08fe512941be9c8091819e817e4c
2017-01-24hwstub/tools/shell: add JZ4760B and Fiio X1 codeAmaury Pouly
The jz code can do several useful things like dumping the IPL and SPL. The Fiio code can play with backlight and has code do dump the IPL and SPL with the correct parameters (extracted by reverse engineering). Change-Id: I317b3174f5db8d38c9a56670c1d45565142ec208
2017-01-24regtools: add JZ4760B descriptionAmaury Pouly
This is a register description file for the JZ4760B. There are several details worth noticing: - it was obtained by gathering information from several sources/headers, but since there are inconsistencies between them about the exact differences between JZ4760 and JZ4760B, this file probably contains some errors - the register names are not the same as the manual ones (which are not the same as the one in the headers anyway): I dropped the "R" suffix on most registers because it's redundant - Ingenic likes to have read-only registers and then set/clr registers, with very confusing names like DIR/DIRS/DIRC: in the file, the set/clr registers are described as set/clr variants of the original register - Parts of the description were obtained programmatically, which explains why there are empty nodes or partially undocumented registers Change-Id: I8da1d61e172e932e1a4a58ac0a5008f02b1751be
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-05 11:01:22 +0000