This fixes a couple of issues when cross-compiling for windows:
- lib builds (i.e. mks5lboot) were overriding the cross CC/CXX with the
native CC, producing incompatible binaries.
- Qt made the accessibility plugin part of the core library, so we no
longer need to import it.
Change-Id: I9d884aee62dfa51d3624a3fa9b99c23b3b375f20
Seems like newer versions of mingw will sponteanously add a .exe suffix to
the output path if it doesn't have one, for example mingw-gcc -o scsitool bla
will actually create scsitool.exe and of course this breaks my release script.
Fix this by explicitely adding the .exe to avoid any problem
Change-Id: Ic8019b968b532b2ca612ba0c03977a96c22cee01
This is one of those fancy gold-plated devices. Of course it breaks my scripts
that were nicely expecting every device to start with NW.
Change-Id: I161320f620f65f4f92c2650d192b26a9831eeb9d
There is something weird going on: the Sony website has two different entries:
- NW-ZX300/NW-ZX300A/NW-A45/NW-A47/NW-A45HN/NW-A46HN
- NW-ZX300,NW-ZX300A update(20181004)/NW-ZX300G
with slightly different nvp entries, but it is impossible to tell whether
an NW-ZX300(A) belong to one or the other. Since the diff is very small,
I am adding this as nw-zx300g but treat all devices as nz-zx300 since the
destination node is the same and that is the main usage of the tool anyway.
Change-Id: I3dc2fdec52650f938d568bed578184f6bc43d130
If the model is not known (ie model ID in the database) but another device from
the same series is known, then the database information probably applies and
one can use the "force" option -s to tell the tool to ignore the model ID.
Automatically print such advice when the series can be guessed.
Change-Id: I6bcc7aa29693df8c3d7d8e709ece7cea650be717
swr/swl instructions used for word aligning were wrong. This
made memset() terribly broken. I can't imagine how it went
uncaught for soooo long. Spotted by Solomon Peachy.
I run unit tests for alignments 0,1,2,3
size 1, 2, 3, 4, 5, 63, 64, 65, 127, 128, 129;
and fill pattern 0x00 and other (since 0 is special case in this
implementation).
Change-Id: I513a10734335fe97734c10ab5a6c3e3fb3f4687a
Previously only atomic read/write 8/16/32 were exposed. But it is useful to
be able to read a whole buffer at once, this is more efficient than N times
read8.
Change-Id: I06e331641e1ab1f74c0e16e8c432eafb398e8e6d
The encryption definitely uses some standard elliptic curve encryption over
binary fields (163 and 233 bits, standard polynomials). It is still unclear
how this is used in the actual encryption, the key authentification and
derivation do not look standard.
Change-Id: I6b9180ff7e6115e1dceca8489e986a02a9ea6fc9
Now print list of devices immediately even if the rest of the command line
is empty (ie 'scsitool -s ?' works, whereas before one would need an actual
device to even get a list). Add more information in the help_us command:
print kas, lyr and fpi.
Change-Id: Icfeeaeebe28c774a74ca54661357fafa25c3d114
The tool now provides more useful information for developers when the device
is not supported. Is also has a new verb "help_us" that also prints all this
information (notably the device info and model ID).
Change-Id: I04baec8fff23eb83a0408add6296b5d42e9aa8e7
We still miss the model IDS for those device so scsitool won't be able to
recognize them automatically.
Change-Id: I17ae0f0d95c011cea8e289def63c7673b6c4b667
DES ignores the parity bit of each byte (making the 64-bit key really 56-bit),
but the current code skipped the parity bit of each half-byte, thus missing
some keys.
Change-Id: Ia523ebb944e458905b7de1742df151df22166150
Strangely it has the SAME encryption key as the E450. Either they didn't bother
changing it or more likely they have exactly the same internals and a slightly
different case.
Change-Id: I39ab88845b3e40db34160c2e61dde421f391df44
SUPPORTED SERIES:
- NWZ-E450
- NWZ-E460
- NWZ-E470
- NWZ-E580
- NWZ-A10
NOTES:
- bootloader makefile convert an extra font to be installed alongside the bootloader
since sysfont is way too small
- the toolsicon bitmap comes from the Oxygen iconset
- touchscreen driver is untested
TODO:
- implement audio routing driver (pcm is handled by pcm-alsa)
- fix playback: it crashes on illegal instruction in DEBUG builds
- find out why the browser starts at / instead of /contents
- implement radio support
- implement return to OF for usb handling
- calibrate battery curve (NB: of can report a battery level on a 0-5 scale but
probabl don't want to use that ?)
- implement simulator build (we need a nice image of the player)
- figure out if we can detect jack removal
POTENTIAL TODOS:
- try to build a usb serial gadget and gdbserver
Change-Id: Ic77d71e0651355d47cc4e423a40fb64a60c69a80
Several people asked me recently how to decrypt atj2127 firmware. Someone
posted on github (https://github.com/nfd/atj2127decrypt) a decrypt utility
clearly reverse engineered from some unknown source. The code is an absolute
horror but I concluded that ATJ changed very little between ATJ213x and ATJ2127
so I added support for the ATJ2127, credit to this github code that I stole
and rewrite (code was under MIT licence). At the same time do some small code
cleanups.
Note that there is not 100% sure way that I know to distinguish between the
two firmware types, so the code tries to do an educated guess to detect
ATJ2127. If this does not work, use --atj21217 option. Also note that contrary
to the github tool that decrypts and unpack in one go, this tool only does one
step at once. So first decrypt: HEX -> AFI, then unpack AFI -> files.
I also added for a different version of AFI. Based on AFI files I have, there
are, I think, two versions: the "old" ones (pre-ATJ213x) and "new" ones. The
tool only supported the new one but for some reason the ATJ2127 uses the old
ones without a mostly empty header. Strangely, even this mostly empty header
does not seem to follow the old layout as reverse engineered by the s1mp3
project (https://sourceforge.net/p/s1mp3/code/HEAD/tree/trunk/s1fwx/heads.h),
so in fact there might be three versions. In any case, only the header is
different, the rest of the file is identical so at the moment I just don't
print any header info for "old" files.
Change-Id: I1de61e64f433f6cacd239cd3c1ba469b9bb12442
The devinfo request returned the raw data, now the tool prints the various
fields. Also add support for the dhp (destination/headphones/color ...): this
one is untested because it's only supported starting from A10 or A20. There is
still a problem with the dpcc prop: although it should work for DEVINFO, it does
not, despite the fact that the get_dev_info command works and is internally (on
the Sony) translated into a dpcc request. I keep the code just in case.
Change-Id: I5aa8ef4afb0b11d3c0ddfa3d38f3e737ee1aff66
The detailled error message is only printed if -d switch is on command line,
otherwise there is no error message which is wrong so fix that.
Change-Id: I397541c467940e9b290ee8d4ae704368b1ce132b
I am unsure about the names of the player, the manual says A36HN and A37HN but
at the same time there is a A35 and A35HN with the same ID, and Sony does not
usually put the "HN" in its device list.
Change-Id: Idbf32970aa334b30f1b8947a78b8eebd524b193b
* make gen_db.py work on Windows/Python 2
- use hashlib module instead of md5sum, also don't rely on / for file path
matching
- don't use 'file' for a variable name
* fix parse_nvp_header.sh for older kernels
pre-emmc kernel sources use a slightly different #define format; adjust
regexp to catch it.
* add nwz-x1000 series NVP layout (from icx1087_nvp.h)
some new tags have no description, alas the driver doesn't have
them :/
* minor fixes to nvp/README
fixed typos/wording
Change-Id: I77d8c2704be2f2316e32aadcfd362df7102360d4
* added KAS for nwz-x1000 (extracted from an NWZ-X1060 via "get_dnk_nvp kas")
* hint that -o is needed when extracting
Change-Id: Ic91c448aa058a22c8ddcae54726f628f7cf60f6b
The code dependend on the sg_lib header being present, remove this dependency
so that we only need public headers.
Change-Id: I69398453635135deb33e2adf67f15ddb80e4ba16
...by QStyleOptionViewItem. Yes Qt got it right, in 5.7 they deprecated
QStyleOptionViewItemV4 and recommend using QStyleOptionViewItem which contains
less fields except on newer Qt where it contains all fields. Hopefully it still
works on Qt>4.x for a large enough value of x.
Change-Id: I013c383d2424b04c1c0745f0d7b1d5e62a29d324
The clock structure is identical, and the EMI are the same.
Also fix SSP clock, it was broken on imx233 as well.
Change-Id: I25ec66059b00b1a456ef2f02131d225082536c0a
Because a node ref is at root doesn't make it valid, check that soc is valid
otherwise we return garbage.
Change-Id: I6e5befc959dc670ab39a87484e87af6d90be7726
Add lua code to check whether ei/di and ext instructions are supported. This
is unclear since xburst is somewhere between mips32r1 and mips32r2. Details
results are below, but in summary: they don't work (ei has no effect, di/ext
cause illegal instruction exceptions)
> ./hwstub_shell -q -b -e 'require("jz/misc"); JZ.misc.enable_sram()' \
-f lua/xburst.lua -e "XBURST.test_ext_inst(0xb32d0000)"
[...]
Selecting soc jz4760b. Redirecting HW to hwstub.soc.jz4760b
data: d7168acf
error: lua/xburst.lua:209: call failed
trapped exception in call
> ./hwstub_shell -q -b -e 'require("jz/misc"); JZ.misc.enable_sram()' \
-f lua/xburst.lua -e "XBURST.test_ei_di_inst(0xb32d0000)"
[...]
Selecting soc jz4760b. Redirecting HW to hwstub.soc.jz4760b
Testing ei
Test SR
Enable interrupts with CP0
SR: 0x1
Disable interrupts with CP0
SR: 0x0
Test ei/di
Enable interrupts with ei
SR: 0x0
Disable interrupts with di
error: lua/xburst.lua:244: call failed
trapped exception in call
Change-Id: I2e162b5dd5e70488bcd8b58f3ca401a3ecab3c4b
Since we can catch exceptions like data aborts on read/write, it takes very
little to also catch exceptions in calls. When extending this with the catching
of illegal instructions, the call instruction now becomes much more robust and
also for address and instruction probing. Since we can catch several types of
exception, rename set_data_abort_jmp to set_exception_jmp. At the same time,
simplify the logic in read/write request handlers. Also fix a bug in ARM
jump code: it was using
stmia r1, {..., pc}
as if pc would get current pc + 8 but this is actually implementation defined
on older ARMs (typically pc + 12) and deprecated on newer ARMs, so rewrite the
code avoid that. The set_exception_jmp() function now also reports the exception
type.
Change-Id: Icd0dd52d2456b361b27c4776be09c3d13528ed93
Now that we now that jz4760b implements EBASE, we can use it to rebase
exceptions to use a k1seg address, that maps to the physical address of the
TCSM0. It requires to enable HAB1 to have this translation. This most the most
inefficient way to access tighly coupled memory ever, but it works.
Change-Id: I894ca929c9835696102eb2fef44b06e6eaf96d44
The JZ misc allows to enable and test SRAM.
The XBurst code uses the coprocessor interface to analyse the cpu. It also
provides a test platform for various features like EBASE and exceptions.
I was able to test and confirm that on jz4760b (thus xburst), EBASE works
(but top 2 bits are not controllable and always 01). The processor claims
to support vector interrupts but this is untested. The values in ConfigX
are not to be trusted blindly, clearly some are wrong. I tried to use the
JZ4780 Config7 "ebase gate" to change bit 30 of EBASE but it does not work,
which suggests that JZ480 uses a newer version of XBurst. Detailled log below:
> ./hwstub_shell -q -f lua/xburst.lua -e "XBURST.init()"
[...]
XBurst:
PRId: 0x2ed0024f
CPU: JZ4760(B)
Config: 0x80000483
Architecture Type: MIPS32
Architecture Level: Release 2 (or more)
MMU Type: Standard TLB
Config1: 0x3e63318a
MMU Size: 32
ICache
Sets per way: 128
Ways: 4
Line size: 32
DCache
Sets per way: 128
Ways: 4
Line size: 32
FPU: no
Config2: 0x80000000
Config3: 0x20
Vectored interrupt: yes
Config7: 0x0
> ./hwstub_shell -q -e 'require("jz/misc"); JZ.misc.enable_sram()' \
-f lua/xburst.lua -e "XBURST.test_ebase(0x80000000);XBURST.test_ebase(0xb32d0000)
[...]
Testing EBASE...
Disable BEV
SR value: 0x2000fc00
EBASE value: 0x80000000
Value after writing 0x80000000: 0x80000000
Value after writing 0x80040000: 0x80040000
Test result: EBase seems to work
Disable config7 gate: write 0x0 to Config7
Value after writing 0xfffff000: 0xbffff000
Enable config7 gate: write 0x80 to Config7
Value after writing 0xc0000000: 0x80000000
Config7 result: Config7 gate does not work
Exception test with EBASE at 0x80000000...
Writing instructions to memory
Old SR: 0x2000fc00
New SR: 0xfc00
EBASE: 80000000
Before: cafebabe
After: deadbeef
Exception result: Exception and EBASE are working
Testing EBASE...
Disable BEV
SR value: 0x2000fc00
EBASE value: 0x80000000
Value after writing 0x80000000: 0x80000000
Value after writing 0x80040000: 0x80040000
Test result: EBase seems to work
Disable config7 gate: write 0x0 to Config7
Value after writing 0xfffff000: 0xbffff000
Enable config7 gate: write 0x80 to Config7
Value after writing 0xc0000000: 0x80000000
Config7 result: Config7 gate does not work
Exception test with EBASE at 0xb32d0000...
Writing instructions to memory
Old SR: 0x2000fc00
New SR: 0xfc00
EBASE: b32d0000
Before: cafebabe
After: deadbeef
Exception result: Exception and EBASE are working
Change-Id: I894227981a141a8c14419b36ed9f519baf145ad1
These macros are like jz_setf but instead of writing fields, they write a
raw value directly: jz_set(REG, value) and jz_clr(REG, value).
Change-Id: I660f20dd691b26d367533877875fc3226a26c992
Apparently I completely forgot to implement it so using hwstub over net would
just fail all EXEC commands :-s
Change-Id: I0d0506cbbce9b86c9a4f19036dacc922d1e51338
This is needed on the jz4760b because if some data is loaded to DRAM, then it
is cached and a disaster lurks if dcaches/icache are not flushed. Targets that
needs this must define CONFIG_FLUSH_CACHES in target-config.h and implement
target_flush_caches(). Currently MIPS has some generic code for mips32r1 that
requires to define {D,I}CACHE_SIZE and {D,I}CACHE_LINE_SIZE in target-config.h
Change-Id: I5a3fc085de9445d8c8a2eb61ae4e2dc9bb6b4e8e
The stub is quite versatile: it can be loaded using bootrom or another other
means (like factory boot on Fiio X1). It relocates itself to TCSM0 and provides
basic functionality (it does not recover from failed read/writes at the moment).
Change-Id: Ib646a4b43fba9358d6f93f0f73a5c2e9bcd775a7
The jz code can do several useful things like dumping the IPL and SPL.
The Fiio code can play with backlight and has code do dump the IPL
and SPL with the correct parameters (extracted by reverse engineering).
Change-Id: I317b3174f5db8d38c9a56670c1d45565142ec208
This is a register description file for the JZ4760B. There are several
details worth noticing:
- it was obtained by gathering information from several sources/headers, but
since there are inconsistencies between them about the exact differences
between JZ4760 and JZ4760B, this file probably contains some errors
- the register names are not the same as the manual ones (which are not the
same as the one in the headers anyway): I dropped the "R" suffix on most
registers because it's redundant
- Ingenic likes to have read-only registers and then set/clr registers, with
very confusing names like DIR/DIRS/DIRC: in the file, the set/clr registers
are described as set/clr variants of the original register
- Parts of the description were obtained programmatically, which explains why
there are empty nodes or partially undocumented registers
Change-Id: I8da1d61e172e932e1a4a58ac0a5008f02b1751be
The code was not updated when I added support for list and other stuff, and thus
it did not properly sort by addresses.
Change-Id: Iaed0717b607beedfb2856c020c2a760e7a5667c5
