void create_menu_entry_debug_screen(void) {
int i;
struct MENU *menu_mem;
int8_t buf[1];
md380_spiflash_read(buf, spi_flash_addl_config_start + offset_debug, 1);
menu_mem = (void *)((md380_menu_memory + ((md380_menu_depth) * sizeof(struct MENU))) + sizeof(struct MENU));
menu_mem->menu_title = wt_debug;
menu_mem->unknownp = 0x14 * md380_menu_id + md380_menu_mem_base;
menu_mem->numberof_menu_entries=2;
menu_mem->unknown_00 = 0;
menu_mem->unknown_01 = 0;
if (buf[0] == '1') {
md380_menu_entry_selected = 0;
global_addl_config.debug = 1;
} else {
md380_menu_entry_selected = 1;
global_addl_config.debug = 0;
}
#ifdef CONFIG_MENU
create_menu_entry_hook( md380_menu_id, wt_enable, create_menu_entry_debug_enable_screen + 1, md380_menu_entry_back+1, 0x8b, 0 , 1);
create_menu_entry_hook( md380_menu_id + 1, wt_disable, create_menu_entry_debug_disable_screen + 1, md380_menu_entry_back+1, 0x8b, 0 , 1);
#endif
for(i=0;i<2;i++) { // not yet known ;)
uint8_t *p;
p = (uint8_t *)md380_menu_mem_base + ( md380_menu_id + i ) * 0x14;
p[0x10] = 0;
}
}
void spiflash_read_hook(void *dst, long adr, long len)
{
#ifdef DEBUG
char *hint = "" ;
#ifdef FW_D13_020
if( dst == zone_name ) {
hint = "zn" ;
} else
if( dst == &contact ) {
hint = "cont" ;
} else
if( dst == ¤t_channel_info ) {
hint = "cci" ;
} else
if( dst == (void*)0x2001de78 ) {
hint = "ci2" ;
} else
if( dst == (void*)0x2001da7c ) {
hint = "rxg" ;
} else
#endif
{
hint = "?" ;
}
PRINTRET();
PRINT("0x%06x:%4d 0x%08x (%s)\n", adr, len, dst, hint);
#endif
md380_spiflash_read(dst, adr, len);
}
void init_global_addl_config_struct() {
int8_t buf[1];
md380_spiflash_read(buf, spi_flash_addl_config_start + offset_rbeep, 1);
if (buf[0] == '1') {
global_addl_config.rbeep = 1;
} else {
global_addl_config.rbeep = 0;
}
md380_spiflash_read(buf, spi_flash_addl_config_start + offset_datef, 1);
if (buf[0] == '0') {
global_addl_config.datef = 0;
}
if (buf[0] == '1') {
global_addl_config.datef = 1;
}
if (buf[0] == '2') {
global_addl_config.datef = 2;
}
if (buf[0] == '3') {
global_addl_config.datef = 3;
}
md380_spiflash_read(buf, spi_flash_addl_config_start + offset_userscsv, 1);
if (buf[0] == '1') {
global_addl_config.userscsv = 1;
} else {
global_addl_config.userscsv = 0;
}
md380_spiflash_read(buf, spi_flash_addl_config_start + offset_debug, 1);
if (buf[0] == '1') {
global_addl_config.debug = 1;
} else {
global_addl_config.debug = 0;
}
md380_spiflash_read(buf, spi_flash_addl_config_start + offset_promtg, 1);
if (buf[0] == '1') {
global_addl_config.promtg=1;
} else {
global_addl_config.promtg=0;
}
md380_spiflash_read(buf, spi_flash_addl_config_start + offset_micbargraph, 1);
if (buf[0] == '1') {
global_addl_config.micbargraph=1;
} else {
global_addl_config.micbargraph=0;
}
// global_addl_config.experimental is intentionally not permanent
global_addl_config.experimental = 0;
}
void create_menu_entry_userscsv_screen(void) {
int i;
struct MENU *menu_mem;
int8_t buf[1];
/*
Previously, this would check the flash type, but as all known
flash chips are at least 1MB, we can skip the check and always use
the memory.
if(check_spi_flash_type()) {
*/
md380_spiflash_read(buf, spi_flash_addl_config_start + offset_userscsv, 1);
menu_mem = (void *)((md380_menu_memory + ((md380_menu_depth) * sizeof(struct MENU))) + sizeof(struct MENU));
menu_mem->menu_title = wt_userscsv;
menu_mem->unknownp = 0x14 * md380_menu_id + md380_menu_mem_base;
menu_mem->numberof_menu_entries=2;
menu_mem->unknown_00 = 0;
menu_mem->unknown_01 = 0;
if (buf[0] == '1') {
md380_menu_entry_selected = 0;
} else {
md380_menu_entry_selected = 1;
}
#ifdef CONFIG_MENU
create_menu_entry_hook( md380_menu_id, wt_enable, create_menu_entry_userscsv_enable_screen + 1, md380_menu_entry_back+1, 0x8b, 0 , 1);
create_menu_entry_hook( md380_menu_id + 1, wt_disable, create_menu_entry_userscsv_disable_screen + 1, md380_menu_entry_back+1, 0x8b, 0 , 1);
#endif
for(i=0;i<2;i++) { // not yet known ;)
uint8_t *p;
p = (uint8_t *)md380_menu_mem_base + ( md380_menu_id + i ) * 0x14;
p[0x10] = 0;
}
/*
} else {
menu_mem = (md380_menu_memory + ((md380_menu_depth) * sizeof(struct MENU))) + sizeof(struct MENU);
menu_mem->menu_title = wt_userscsv;
menu_mem->unknownp = 0x14 * md380_menu_id + md380_menu_mem_base;
menu_mem->numberof_menu_entries=1;
menu_mem->unknown_00 = 0;
menu_mem->unknown_01 = 0;
create_menu_entry_hook( md380_menu_id, wt_no_w25q128, md380_menu_entry_back+1, md380_menu_entry_back+1, 6, 2 , 1);
}
*/
}
//---------------------------------------------------------------------------
BOOL ZoneList_ReadNameByIndex( int index, // [in] zero-based zone index
char *psz20ZoneName ) // [out] zone name as a C string
// Return value : TRUE when successfully read a zone name for this index,
// FALSE when failed or not implemented for a certain firmware.
{
wchar_t wc16Temp[20]; // don't use global variables here.. so roll our zone-list-reader
if( index>=0 && index<CODEPLUG_MAX_ZONE_LIST_ENTRIES )
{ md380_spiflash_read( wc16Temp, index * CODEPLUG_SIZEOF_ZONE_LIST_ENTRY
+ CODEPLUG_SPIFLASH_ADDR_ZONE_LIST,
16 * sizeof(wchar_t) );
wc16Temp[16] = 0; // convert from wasteful 'wide' string into a good old "C"-string:
wide_to_C_string( wc16Temp, psz20ZoneName, 16+1 );
// unused entries in the codeplug appeared 'zeroed' (filled with 0x00),
// thus 0x00 in the first character seems to mark the end of the list:
return wc16Temp[0] != 0;
}
else
{ psz20ZoneName[0] = '\0';
return FALSE;
}
} // end ZoneList_ReadNameByIndex()
int usb_dnld_hook(){
/* These are global buffers to the packet data, its length, and the
block address that it runs to. The stock firmware has a bug
in that it assumes the packet size is always 2048 bytes.
*/
static char *packet=(char*) 0x200199f0;//2.032
static int *packetlen=(int*) 0x2001d20c;//2.032
static int *blockadr=(int*) 0x2001d208;//2.032
static char *dfu_state=(char*) 0x2001d405;//2.032
static char **dfu_target_adr=(char**) 0x2000112c; //2.032
//Don't know what these do.
//char *thingy=(char*) 0x2001d276;
char *thingy2=(char*) 0x2001d041;
int state;
/* DFU transfers begin at block 2, and special commands hook block
0. We'll use block 1, because it handily fits in the gap without
breaking backward compatibility with the older code.
*/
if(*blockadr==1){
switch(packet[0]){
//Memory commands
case TDFU_DMESG:
//The DMESG buffer might move, so this command
//sets the target address to the DMESG buffer.
*dfu_target_adr=dmesg_start;
break;
//SPI-FLASH commands
case TDFU_SPIFLASHGETID:
//Re-uses the dmesg transmit buffer.
*dfu_target_adr=dmesg_tx_buf;
get_spi_flash_type((void *) dmesg_tx_buf); // 0x00aabbcc aa=MANUFACTURER ID, bb,cc Device Identification
break;
case TDFU_SPIFLASHREAD:
//Re-uses the dmesg transmit buffer.
*dfu_target_adr=dmesg_tx_buf;
uint32_t adr= *((uint32_t*)(packet+1));
printf("Dumping %d bytes from 0x%08x in SPI Flash\n",
DMESG_SIZE, adr);
md380_spiflash_read(dmesg_tx_buf,
adr,
DMESG_SIZE);
break;
case TDFU_SPIFLASHWRITE:
//Re-uses the dmesg transmit buffer.
*dfu_target_adr=dmesg_tx_buf;
adr = *((uint32_t*)(packet+1));
uint32_t size = *((uint32_t*)(packet+5));
memset(dmesg_tx_buf,0,DMESG_SIZE);
if (check_spi_flash_type()) {
printf ("TDFU_SPIFLASHWRITE %x %d %x\n", adr, size, packet+9);
md380_spiflash_write(packet+9, adr, size);
}
break;
case TDFU_SPIFLASHERASE64K: // experimental
//Re-uses the dmesg transmit buffer.
*dfu_target_adr=dmesg_tx_buf;
adr= *((uint32_t*)(packet+1));
memset(dmesg_tx_buf,0,DMESG_SIZE);
if (check_spi_flash_type()) {
printf ("TDFU_SPIFLASHERASE64K %x \n", adr);
// spiflash_wait();
// spiflash_block_erase64k(adr);
md380_spiflash_enable();
md380_spi_sendrecv(0x6);
md380_spiflash_disable();
md380_spiflash_enable();
md380_spi_sendrecv(0xd8);
md380_spi_sendrecv((adr>> 16) & 0xff);
md380_spi_sendrecv((adr>> 8) & 0xff);
md380_spi_sendrecv(adr & 0xff);
md380_spiflash_disable();
}
// md380_spiflash_wait(); // this is the problem :(
// must be polled via dfu commenad?
break;
case TDFU_SPIFLASHWRITE_NEW: // not working, this is not the problem
//Re-uses the dmesg transmit buffer.
*dfu_target_adr=dmesg_tx_buf;
adr = *((uint32_t*)(packet+1));
size = *((uint32_t*)(packet+5));
memset(dmesg_tx_buf,0,DMESG_SIZE);
if (check_spi_flash_type()) {
printf ("DFU_SPIFLASHWRITE_new %x %d %x\n", adr, size, packet+9);
// enable write
for (int i=0;i<size;i=i+256) {
int page_adr;
page_adr=adr+i;
printf("%d %x\n",i,page_adr);
md380_spiflash_wait();
md380_spiflash_enable();
md380_spi_sendrecv(0x6);
md380_spiflash_disable();
md380_spiflash_enable();
md380_spi_sendrecv(0x2);
printf("%x ", ((page_adr>> 16) & 0xff));
md380_spi_sendrecv((page_adr>> 16) & 0xff);
printf("%x ", ((page_adr>> 8) & 0xff));
md380_spi_sendrecv((page_adr>> 8) & 0xff);
printf("%x ", (page_adr & 0xff));
md380_spi_sendrecv(page_adr & 0xff);
for (int ii=0; ii < 256; ii++) {
md380_spi_sendrecv(packet[9+ii+i]);
}
md380_spiflash_disable();
md380_spiflash_wait();
printf("\n");
}
}
break;
case TDFU_SPIFLASHSECURITYREGREAD:
//Re-uses the dmesg transmit buffer.
*dfu_target_adr=dmesg_tx_buf;
printf("Dumping %d bytes from adr 0 SPI Flash security_registers\n",
DMESG_SIZE);
md380_spiflash_security_registers_read(dmesg_tx_buf,
0,
3*256);
break;
//Radio Commands
case TDFU_C5000_READREG:
//Re-uses the dmesg transmit buffer.
*dfu_target_adr=dmesg_tx_buf;
memset(dmesg_tx_buf,0,DMESG_SIZE);
state=OS_ENTER_CRITICAL();
c5000_spi0_readreg(packet[1],dmesg_tx_buf);
OS_EXIT_CRITICAL(state);
break;
case TDFU_C5000_WRITEREG:
//Re-uses the dmesg transmit buffer.
*dfu_target_adr=dmesg_tx_buf;
memset(dmesg_tx_buf,0,DMESG_SIZE);
state=OS_ENTER_CRITICAL();
c5000_spi0_writereg(packet[1],packet[2]);
OS_EXIT_CRITICAL(state);
break;
//Graphics commands.
case TDFU_PRINT: // 0x80, u8 x, u8 y, u8 str[].
drawtext((wchar_t *) (packet+3),
packet[1],packet[2]);
break;
case TDFU_BOX:
default:
printf("Unhandled DFU packet type 0x%02x.\n",packet[0]);
}
thingy2[0]=0;
thingy2[1]=0;
thingy2[2]=0;
thingy2[3]=3;
*dfu_state=3;
*blockadr=0;
*packetlen=0;
return 0;
}else{
/* For all other blocks, we default to the internal handler.
*/
return usb_dnld_handle();
/* All user database data is accessed through this function.
* This makes it easier to adapt to different kinds of sources.
*/
static char * getdata(char * dest, const char * src, int count) {
md380_spiflash_read(dest, (long) src, count);
return dest;
}
int (spiflash_read_hook)(void *dst, long adr, long len) {
printf("%x %x %d\n", dst, adr, len);
return md380_spiflash_read(dst, adr, len);
}
int usb_dnld_hook(){
/* These are global buffers to the packet data, its length, and the
block address that it runs to. The stock firmware has a bug
in that it assumes the packet size is always 2048 bytes.
*/
int state;
/* DFU transfers begin at block 2, and special commands hook block
0. We'll use block 1, because it handily fits in the gap without
breaking backward compatibility with the older code.
*/
if(*md380_blockadr==1){
switch(md380_packet[0]){
//Memory commands
case TDFU_DMESG:
//The DMESG buffer might move, so this command
//sets the target address to the DMESG buffer.
*md380_dfu_target_adr=dmesg_start;
break;
//SPI-FLASH commands
#ifdef CONFIG_SPIFLASH
case TDFU_SPIFLASHGETID:
//Re-uses the dmesg transmit buffer.
*md380_dfu_target_adr=dmesg_tx_buf;
get_spi_flash_type((void *) dmesg_tx_buf); // 0x00aabbcc aa=MANUFACTURER ID, bb,cc Device Identification
break;
case TDFU_SPIFLASHREAD:
//Re-uses the dmesg transmit buffer.
*md380_dfu_target_adr=dmesg_tx_buf;
uint32_t adr= *((uint32_t*)(md380_packet+1));
printf("Dumping %d bytes from 0x%08x in SPI Flash\n",
DMESG_SIZE, adr);
md380_spiflash_read(dmesg_tx_buf,
adr,
DMESG_SIZE);
break;
case TDFU_SPIFLASHWRITE:
//Re-uses the dmesg transmit buffer.
*md380_dfu_target_adr=dmesg_tx_buf;
adr = *((uint32_t*)(md380_packet+1));
uint32_t size = *((uint32_t*)(md380_packet+5));
memset(dmesg_tx_buf,0,DMESG_SIZE);
if (check_spi_flash_size()>adr) {
printf ("TDFU_SPIFLASHWRITE %x %d %x\n", adr, size, md380_packet+9);
md380_spiflash_write(md380_packet+9, adr, size);
}
break;
case TDFU_SPIFLASHERASE64K: // experimental
//Re-uses the dmesg transmit buffer.
*md380_dfu_target_adr=dmesg_tx_buf;
adr= *((uint32_t*)(md380_packet+1));
memset(dmesg_tx_buf,0,DMESG_SIZE);
if (check_spi_flash_size()>adr) {
printf ("TDFU_SPIFLASHERASE64K %x \n", adr);
// spiflash_wait();
// spiflash_block_erase64k(adr);
md380_spiflash_enable();
md380_spi_sendrecv(0x6);
md380_spiflash_disable();
md380_spiflash_enable();
md380_spi_sendrecv(0xd8);
md380_spi_sendrecv((adr>> 16) & 0xff);
md380_spi_sendrecv((adr>> 8) & 0xff);
md380_spi_sendrecv(adr & 0xff);
md380_spiflash_disable();
}
// md380_spiflash_wait(); // this is the problem :(
// must be polled via dfu commenad?
break;
case TDFU_SPIFLASHWRITE_NEW: // not working, this is not the problem
//Re-uses the dmesg transmit buffer.
*md380_dfu_target_adr=dmesg_tx_buf;
adr = *((uint32_t*)(md380_packet+1));
size = *((uint32_t*)(md380_packet+5));
memset(dmesg_tx_buf,0,DMESG_SIZE);
if (check_spi_flash_size()>adr) {
printf ("DFU_CONFIG_SPIFLASHWRITE_new %x %d %x\n", adr, size, md380_packet+9);
// enable write
for (int i=0;i<size;i=i+256) {
int page_adr;
page_adr=adr+i;
printf("%d %x\n",i,page_adr);
md380_spiflash_wait();
md380_spiflash_enable();
md380_spi_sendrecv(0x6);
md380_spiflash_disable();
md380_spiflash_enable();
md380_spi_sendrecv(0x2);
printf("%x ", ((page_adr>> 16) & 0xff));
md380_spi_sendrecv((page_adr>> 16) & 0xff);
printf("%x ", ((page_adr>> 8) & 0xff));
md380_spi_sendrecv((page_adr>> 8) & 0xff);
printf("%x ", (page_adr & 0xff));
md380_spi_sendrecv(page_adr & 0xff);
for (int ii=0; ii < 256; ii++) {
md380_spi_sendrecv(md380_packet[9+ii+i]);
}
md380_spiflash_disable();
md380_spiflash_wait();
printf("\n");
}
}
break;
case TDFU_SPIFLASHSECURITYREGREAD:
//Re-uses the dmesg transmit buffer.
*md380_dfu_target_adr=dmesg_tx_buf;
printf("Dumping %d bytes from adr 0 SPI Flash security_registers\n",
DMESG_SIZE);
md380_spiflash_security_registers_read(dmesg_tx_buf,
0,
3*256);
break;
#endif //CONFIG_SPIFLASH
#ifdef CONFIG_SPIC5000
//Radio Commands
case TDFU_C5000_READREG:
//Re-uses the dmesg transmit buffer.
*md380_dfu_target_adr=dmesg_tx_buf;
memset(dmesg_tx_buf,0,DMESG_SIZE);
state=OS_ENTER_CRITICAL();
c5000_spi0_readreg(md380_packet[1],dmesg_tx_buf);
OS_EXIT_CRITICAL(state);
break;
case TDFU_C5000_WRITEREG:
//Re-uses the dmesg transmit buffer.
*md380_dfu_target_adr=dmesg_tx_buf;
memset(dmesg_tx_buf,0,DMESG_SIZE);
state=OS_ENTER_CRITICAL();
c5000_spi0_writereg(md380_packet[1],md380_packet[2]);
OS_EXIT_CRITICAL(state);
break;
#endif //CONFIG_SPIC5000
#ifdef CONFIG_GRAPHICS
//Graphics commands.
case TDFU_PRINT: // 0x80, u8 x, u8 y, u8 str[].
drawtext((wchar_t *) (md380_packet+3),
md380_packet[1],md380_packet[2]);
break;
case TDFU_BOX:
break;
#endif //CONFIG_GRAPHICS
case TDFU_SYSLOG:
syslog_dump_dmesg();
break;
default:
printf("Unhandled DFU packet type 0x%02x.\n",md380_packet[0]);
}
//---------------------------------------------------------------------------
BOOL ZoneList_SetZoneByIndex( int index ) // [in] zero-based zone index
{
wchar_t wc16Temp[20];
#ifdef CODEPLUG_RAM_ADDR_ZONE_NUMBER_STRUCT
zone_number_t *pZoneStruct;
#endif
// Summary of 'zone-related' variables and functions, with addresses for D13.020 (RAM, SPI-Flash) :
// - zone_data_64byte @ 0x2001e218 : Seems to be a 64 byte structure with the
// NAME (16 wide chars) in the first 32 bytes, and something unknown in the remaining 32 bytes.
// 0x2001e218 is the destination address when reading *64* bytes from SPI-flash, see 0x08022d74.
// - zone_name @ first part often had the same content as zone_name at 0x2001cddc .
// - the "zone number" is part of another FOUR- or FIVE-BYTE struct, begin at 0x2001e57c,
// ONE-based index in byte[3] (@0x2001e57F).
// The 'last used zone-number-struct' is stored in SPI-flash at offset 0x02F000, see 0x08022ece .
// That SPI-flash memory region doesn't seem to belong to the CODEPLUG !
// Examined the 'zone-number-struct' in RAM and in SPI-flash with 'HexMon' (amenu_hexmon.c) :
// > 2001E57C : FF FF FF 01 FF (when the FIRST zone was active)
// > C002F000 : FF FF FF 01 FF (which confirms the non-volatile storage address for the ZONE NUMBER)
// ( |_ (address bits 31..28 = "C" informed HexMon to read from SPI-Flash, not the CPU's address space)
// Maybe we can switch to a different zone here WITHOUT overwriting the setting in SPI-flash ? See below..
if( index>=0 && index<CODEPLUG_MAX_ZONE_LIST_ENTRIES )
{
# if( 1 )
// Simply overwriting the two incarnations of 'zone_name' below
// doesn't switch to a different zone. The *CHANNEL* data must
// be re-loaded from the codeplug, too !
md380_spiflash_read( wc16Temp,
index * CODEPLUG_SIZEOF_ZONE_LIST_ENTRY
+ CODEPLUG_SPIFLASH_ADDR_ZONE_LIST,
16 * sizeof(wchar_t) );
if( wc16Temp[0] != 0 ) // name looks valid..
{
# if( HAVE_ZONE_NAME )
memcpy( zone_name, wc16Temp, 16 * sizeof(wchar_t) );
# endif
# if( HAVE_ZONE_NAME_2 )
memcpy( zone_name_2, wc16Temp, 16 * sizeof(wchar_t) );
# endif
}
// Imitate some of the code at 0x08013418 in D13.020 ...
// This is possibly the stuff called when 'confirming' a new zone in Tytera's original menu.
// There seems to be a FIVE-BYTE struct with the ZONE NUMBER at byte-offset #3.
// It lives in SPI-flash (at 0x2F000?), and there's a copy in Tytera's part of the RAM:
# ifdef CODEPLUG_RAM_ADDR_ZONE_NUMBER_STRUCT /* 0x2001E57C in D13.020, ymmv.. */
pZoneStruct = (zone_number_t *)CODEPLUG_RAM_ADDR_ZONE_NUMBER_STRUCT;
pZoneStruct->zone_index = index+1; // written by a Pascal fan, array-indices start at ONE
// Leave the other four (unknown) bytes in the 'zone-number-struct' unchanged.
// The above switches the ZONE (temporarily, until power-off) but it doesn't
// reload the parameters for the CURRENT CHANNEL from that zone.
// Rotating the channel knob would fix that, but we can persuade the original firmware
// to 'load' all channel-depending parameter for the NEW ZONE this way:
channel_num = 0; // <- lets Tytera's part of the firmware "re-load"
// data for the current channel in the NEW ZONE from the codeplug .
// The effect can be seen almost immediately in the application menu:
// Set a new zone (selected from the list), and the name of the CHANNEL
// also changes in the menu.
# endif // < do we know the address of the "zone-number-struct" in RAM > ?
# else // try something else because the above didn't work...
# endif // (old,new) ?
} // end if < valid array index for the zone list >
return FALSE;
} // end ZoneList_SetZoneByIndex()
void cfg_read_struct( addl_config_t *cfg )
{
md380_spiflash_read(cfg, spi_flash_addl_config_start, sizeof(addl_config_t));
}
