Menu
▾
▴
[Hackndev-commit] SF.net SVN: hackndev: [969] linux4palm/tools
|
From: <z7...@us...> - 2007-05-04 09:15:56
|
Revision: 969
http://svn.sourceforge.net/hackndev/?rev=969&view=rev
Author: z72ka
Date: 2007-05-04 02:15:49 -0700 (Fri, 04 May 2007)
Log Message:
-----------
Added modified bcm2035-tool to SVN. Now is the baddr of BT chip as argument.
Added Paths:
-----------
linux4palm/tools/bcm2035-tool/
linux4palm/tools/bcm2035-tool/Makefile
linux4palm/tools/bcm2035-tool/README
linux4palm/tools/bcm2035-tool/bcm2035-tool.c
linux4palm/tools/bcm2035-tool/bcm2035-tool.h
linux4palm/tools/bcm2035-tool/motorola_patches.h
Added: linux4palm/tools/bcm2035-tool/Makefile
===================================================================
--- linux4palm/tools/bcm2035-tool/Makefile (rev 0)
+++ linux4palm/tools/bcm2035-tool/Makefile 2007-05-04 09:15:49 UTC (rev 969)
@@ -0,0 +1,9 @@
+P=arm-none-linux-gnueabi-
+
+bcm2035-tool: bcm2035-tool.c bcm2035-tool.h
+ ${P}gcc bcm2035-tool.c -o bcm2035-tool
+
+clean:
+ rm -f bcm2035-tool
+
+
Property changes on: linux4palm/tools/bcm2035-tool/Makefile
___________________________________________________________________
Name: svn:executable
+ *
Added: linux4palm/tools/bcm2035-tool/README
===================================================================
--- linux4palm/tools/bcm2035-tool/README (rev 0)
+++ linux4palm/tools/bcm2035-tool/README 2007-05-04 09:15:49 UTC (rev 969)
@@ -0,0 +1,106 @@
+BCM2035-tool
+************
+
+ This package contains a small utility to initialize and to update
+the firmware of the bcm2035 bluetooth chip on the Motorola EZX Platform and
+Palm devices with this chip.
+
+ This chip has some custom HCI commands, to change the BDADDR and to
+patch the original firmware. This tool can make use of both.
+
+Instructions:
+-------------
+
+
+ You can use the motorola firmware by #defining PATCH_FIRMWARE, and the
+Broadcom original firmware by leaving it commented. The chip works fine with
+both firmwares, and i havent found yet what difference the motorola version
+does.
+ Turn on the chip by sending "AT+EBTP=1\r" to BP, and run the tool.
+
+
+Regards,
+
+Daniel Ribeiro
+
+--------
+
+Extension by 72ka - Jan Herman <2h...@se...>:
+
+usage: bcm2035-tool <dev> <bdaddr>
+
+MAC address is as command. Remember original MAC addres from PalmOS and use in argument <bdaddr>
+
+e.g.
+
+bcm2035-tool /dev/ttyS1 00:07:8a:78:e3:23
+
+-------
+
+wyrm@vault:~/bcm2035-tool$ make upload
+/ezx/cross/bin/arm-angstrom-linux-gnueabi-gcc bcm2035-tool.c -o bcm2035-tool
+scp bcm2035-tool root@a780:
+root@a780's password:
+bcm2035-tool 100% 15KB 15.3KB/s 00:00
+wyrm@vault:~/bcm2035-tool$ a780
+root@a780's password:
+root@a780:~$ echo -e "AT+EBTP=1\r" | nc localhost 7104
+
+OK
+
+root@a780:~$ ./bcm2035-tool /dev/ttyS1
+Set baud: 921600
+Patching Firmware...
+:0: Wrote 17 bytes
+:1: Wrote 33 bytes
+:2: Wrote 78 bytes
+:3: Wrote 15 bytes
+:4: Wrote 76 bytes
+:5: Wrote 25 bytes
+:6: Wrote 127 bytes
+:7: Wrote 13 bytes
+:8: Wrote 185 bytes
+:9: Wrote 572 bytes
+:10: Wrote 31 bytes
+:11: Wrote 76 bytes
+:12: Wrote 41 bytes
+:13: Wrote 113 bytes
+:14: Wrote 56 bytes
+:15: Wrote 39 bytes
+:16: Wrote 29 bytes
+:17: Wrote 56 bytes
+:18: Wrote 39 bytes
+:19: Wrote 82 bytes
+:20: Wrote 33 bytes
+:21: Wrote 29 bytes
+:22: Wrote 43 bytes
+:23: Wrote 86 bytes
+:24: Wrote 146 bytes
+:25: Wrote 11 bytes
+@0: Wrote 82 bytes
+@1: Wrote 6170 bytes
+Set baud: 460800
+root@a780:~$ hciconfig hci0 up
+root@a780:~$ hciconfig hci0
+hci0: Type: UART
+ BD Address: 01:23:45:67:89:AB ACL MTU: 377:10 SCO MTU: 64:0
+ UP RUNNING PSCAN ISCAN
+ RX bytes:79 acl:0 sco:0 events:8 errors:0
+ TX bytes:39 acl:0 sco:0 commands:8 errors:0
+
+root@a780:~$ hciconfig hci0 version
+hci0: Type: UART
+ BD Address: 01:23:45:67:89:AB ACL MTU: 377:10 SCO MTU: 64:0
+ HCI Ver: 1.1 (0x1) HCI Rev: 0x3 LMP Ver: 1.1 (0x1) LMP Subver: 0x700
+ Manufacturer: Broadcom Corporation (15)
+root@a780:~$ hciconfig hci0 revision
+ hci0: Type: UART
+ BD Address: 01:23:45:67:89:AB ACL MTU: 377:10 SCO MTU: 64:0
+ Firmware 3.7 / 0
+root@a780:~$ hcitool dev
+Devices:
+ hci0 01:23:45:67:89:AB
+root@a780:~$ hcitool scan
+Scanning ...
+ 00:07:A4:58:05:B0 Motorola HS810
+
Property changes on: linux4palm/tools/bcm2035-tool/README
___________________________________________________________________
Name: svn:executable
+ *
Added: linux4palm/tools/bcm2035-tool/bcm2035-tool.c
===================================================================
--- linux4palm/tools/bcm2035-tool/bcm2035-tool.c (rev 0)
+++ linux4palm/tools/bcm2035-tool/bcm2035-tool.c 2007-05-04 09:15:49 UTC (rev 969)
@@ -0,0 +1,268 @@
+/* bcm2035-tool
+ *
+ * (C) 2007 by Daniel Ribeiro <dr...@gm...>
+ *
+ * MAC address as argument extension by: Jan Herman <2h...@se...>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+/* Default MAC address is 01:02:03:04:05:06 */
+#define BDADDR "\x06\x05\x04\x03\x02\x01"
+
+//#define PATCH_FIRMWARE
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <linux/types.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <termios.h>
+#include "bcm2035-tool.h"
+#include "bluetooth.h"
+
+#ifdef PATCH_FIRMWARE
+#include "motorola_patches.h"
+
+__u8 checksum(char *data, int size)
+{
+ __u8 ret = 0;
+ int i;
+
+ for(i=0; i<size; i++)
+ ret-=data[i];
+ return(ret);
+}
+
+
+char a_buffer[43];
+char *generate_packet(__u8 kind, __u16 address, __u8 flag, __u8 size, char *data)
+{
+ char b_buffer[21];
+ char t_buffer[2];
+ __u8 y, i;
+ __u8 x = 0;
+
+ b_buffer[x++] = size;
+ b_buffer[x++] = (__u8) (address >> 8);
+ b_buffer[x++] = (__u8) address;
+ if (kind)
+ b_buffer[x++] = flag;
+ memcpy((char *)b_buffer + x, data, size);
+ x+=size;
+ b_buffer[x] = checksum(b_buffer, x);
+ x++;
+
+ for(i=0,y=0;i<x;i++)
+ {
+ sprintf(t_buffer, "%.2X", (__u8) b_buffer[i]);
+ a_buffer[y++] = t_buffer[0];
+ a_buffer[y++] = t_buffer[1];
+ }
+ a_buffer[y] = 0;
+ return((char *)a_buffer);
+}
+
+int send_patch(int fd, struct patch p, __u8 kind)
+{
+ int n;
+ char t[50];
+ int ret = 0;
+ // p.size == 0 has special treatment
+ if (p.size == 0) {
+ sprintf (t, ":%s", generate_packet(kind, p.address, p.flag,
+ p.size, p.data));
+ ret += write(fd, t, strlen(t));
+ read (fd, t, 8);
+ if (t[0] != '.')
+ exit(-2);
+
+ }
+ else for (n=0;n<p.size;n+=MAXWRITESIZE) {
+ sprintf (t, "%s%s", (kind?":":"@00"), generate_packet(kind,
+ p.address + n, p.flag, (p.size - n > MAXWRITESIZE ?
+ MAXWRITESIZE : p.size - n), p.data + n));
+ ret += write(fd, t, strlen(t));
+ read (fd, t, 8);
+ if (!kind && strncmp(t, "@01", 3))
+ exit (-3);
+ if (kind && t[0] != '.')
+ exit (-2);
+
+
+ }
+ return(ret);
+}
+#endif // PATCH_FIRMWARE
+
+int send_cmd (int fd, char *cmd, char *arg, int argsize)
+{
+ char buf[16];
+ int x = 0;
+ buf[x++] = 0x01;
+ memcpy(buf + x, cmd, 2);
+ x+=2;
+ buf[x++] = (__u8) argsize;
+ if(argsize > 0)
+ {
+ memcpy(buf + x, arg, argsize);
+ x+=argsize;
+ }
+ write(fd, buf, x);
+ read(fd, buf, 8);
+ if (strncmp(buf, REP, 3) != 0 || buf[3] != 1 ||
+ strncmp(buf+4, cmd, 2) != 0 || buf[6] != 0) {
+ printf(" unexpected reply\n");
+ exit(-10);
+ }
+
+}
+
+#ifdef PATCH_FIRMWARE
+int patch_fw(int fd, struct patch p1[], struct patch p2[])
+{
+ int i;
+ char buf[8];
+
+ printf("Patching Firmware...\n");
+ send_cmd(fd, CMD_PATCH_FW, NULL, 0);
+
+ read(fd, buf, 8);
+
+ for (i=0;p1[i].data!=NULL;i++)
+ printf(":%d: Wrote %d bytes\n", i, send_patch(fd, p1[i], 1));
+
+ for (i=0;p2[i].data!=NULL;i++)
+ printf("@%d: Wrote %d bytes\n", i, send_patch(fd, p2[i], 0));
+
+ write(fd, "Z", 1);
+}
+#endif
+
+int set_baud(int fd, int baud)
+{
+ struct termios t;
+ char buf[8];
+
+ printf("Set baud: %d\n", baud);
+ tcgetattr(fd, &t);
+ switch (baud) {
+ case 115200:
+ send_cmd(fd, CMD_SET_BAUD, BAUD115200, 2);
+ cfsetospeed(&t, B115200);
+ break;
+ case 460800:
+ send_cmd(fd, CMD_SET_BAUD, BAUD460800, 2);
+ cfsetospeed(&t, B460800);
+ break;
+ case 921600:
+ send_cmd(fd, CMD_SET_BAUD, BAUD921600, 2);
+ cfsetospeed(&t, B921600);
+ break;
+ default:
+ printf ("invalid baud rate!\n");
+ return(-1);
+ }
+ return tcsetattr(fd, TCSANOW, &t);
+
+}
+
+void mac2hex(const char *mac, u_char *dst)
+{
+
+ int i;
+ long l;
+ char *pp;
+
+ while (isspace(*mac))
+ mac++;
+
+ /* expect 6 hex octets separated by ':' or space/NUL if last octet */
+ for (i = 0; i < 6; i++) {
+ l = strtol(mac, &pp, 16);
+ if (pp == mac || l > 0xFF || l < 0)
+ return;
+ if (!(*pp == ':' || (i == 5 && (isspace(*pp) || *pp == '\0'))))
+ return;
+ /* 5-i swaps hex chars */
+ dst[5-i] = (u_char) l;
+ mac = pp + 1;
+ }
+ }
+
+char *bdaddr[6];
+
+int main(int argc, char **argv)
+{
+ int fd, i;
+ struct termios term;
+ char buf[1024];
+
+ if (argc < 3) {
+ printf("BCM2035 Tool:\n");
+ printf("Usage: %s <device> <bdaddr>\n", argv[0]);
+ exit(1);
+ }
+
+ /* MAC address is required */
+
+ if (strlen(argv[2]) < 17) {
+ printf("invalid argument %s!\n", argv[2]);
+ exit(1);
+ }
+
+ /* Converts MAC address to swapped HEX */
+ mac2hex(argv[2], &bdaddr);
+
+ fd = open (argv[1], O_RDWR | O_NOCTTY );
+
+ if(fd < 0) exit(-1);
+
+ term.c_iflag=0x5;
+ term.c_oflag=0;
+ term.c_cflag=0x1cb2;
+ term.c_lflag=0;
+ term.c_line=0;
+ memcpy(term.c_cc, "\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", NCCS);
+ ioctl (fd, TCSETS, &term);
+
+ send_cmd(fd, CMD_RESET, NULL, 0);
+#ifdef PATCH_FIRMWARE
+ set_baud(fd, 921600);
+ patch_fw(fd, motorola_patches, motorola_firmware);
+ sleep(5);
+#endif
+ set_baud(fd, 460800);
+
+ send_cmd(fd, CMD_SET_BDADDR, bdaddr, 6);
+
+ i = N_HCI;
+ if (ioctl(fd, TIOCSETD, &i) < 0) {
+ perror("Can't set line discipline");
+ exit(1);
+ }
+ if (ioctl(fd, HCIUARTSETPROTO, 0) < 0) {
+ perror("Can't set device");
+ exit(1);
+ }
+ if (fork())
+ return 0;
+ while (1) sleep(999999999);
+ return 0;
+}
Property changes on: linux4palm/tools/bcm2035-tool/bcm2035-tool.c
___________________________________________________________________
Name: svn:executable
+ *
Added: linux4palm/tools/bcm2035-tool/bcm2035-tool.h
===================================================================
--- linux4palm/tools/bcm2035-tool/bcm2035-tool.h (rev 0)
+++ linux4palm/tools/bcm2035-tool/bcm2035-tool.h 2007-05-04 09:15:49 UTC (rev 969)
@@ -0,0 +1,49 @@
+/* bcm2035-tool - bcm2035 tool for Motorola EZX phones
+ *
+ * (C) 2007 by Daniel Ribeiro <dr...@gm...>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+
+#define HCIUARTSETPROTO _IOW('U', 200, int)
+
+#define MAXWRITESIZE 16
+
+struct cmd {
+ char *cmd;
+ int size;
+ char *reply;
+};
+
+struct patch {
+ __u16 address;
+ __u8 flag;
+ int size;
+ char *data;
+};
+
+#define REP "\x04\x0e\x04"
+
+#define BAUD115200 "\x00\xf3"
+#define BAUD460800 "\x22\xfd"
+#define BAUD921600 "\x55\xff"
+
+#define CMD_SET_BAUD "\x18\xfc"
+#define CMD_RESET "\x03\x0c"
+#define CMD_PATCH_FW "\x2e\xfc"
+#define CMD_SET_BDADDR "\x01\xfc"
+
+
Property changes on: linux4palm/tools/bcm2035-tool/bcm2035-tool.h
___________________________________________________________________
Name: svn:executable
+ *
Added: linux4palm/tools/bcm2035-tool/motorola_patches.h
===================================================================
--- linux4palm/tools/bcm2035-tool/motorola_patches.h (rev 0)
+++ linux4palm/tools/bcm2035-tool/motorola_patches.h 2007-05-04 09:15:49 UTC (rev 969)
@@ -0,0 +1,10 @@
+/*
+ * This file contains binary firmware code and cant be freely distributed.
+ * If you own an ezx phone and wants this file i can tell you how to
+ * create it based on the "dload" app of the motorola firmware.
+ */
+
+#error This file cant be distributed on OpenEZX servers.
+
+struct patch motorola_patches[];
+struct patch motorola_firmware[];
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|
