+/* limitations:
+ * - bytes must be multiple of 64
+ * - bytes must be less than 16k
+ * - must perform even number of reads, or dev hangs on exit (firmware bug?) */
+static int rw_rom_block(struct usb_dev_handle *dev, u32 addr, void *buffer, int bytes, int is_w)
+{
+ dev_cmd_t cmd;
+ int ret;
+
+ prepare_cmd(&cmd, is_w ? CMD_SEC_WRITE : CMD_SEC_READ);
+ cmd.write_flag = is_w ? 1 : 0;
+ cmd.rom_rw.addrb2 = addr >> (16 + 1);
+ cmd.rom_rw.addrb1 = addr >> (8 + 1);
+ cmd.rom_rw.addrb0 = addr >> 1;
+ cmd.rom_rw.param = bytes / 64;
+ cmd.rom_rw.param2 = is_w ? 1 : 0; /* ? */
+
+ ret = write_cmd(dev, &cmd);
+ if (ret < 0)
+ return ret;
+
+ bytes &= ~63;
+
+ if (is_w)
+ ret = write_data(dev, buffer, bytes);
+ else
+ ret = read_data(dev, buffer, bytes);
+ if (ret < 0)
+ return ret;
+
+ if (ret != bytes)
+ fprintf(stderr, "rw_rom_block warning: done only %d/%d bytes\n", ret, bytes);
+
+ return ret;
+}
+
+static int read_write_rom(struct usb_dev_handle *dev, u32 addr, void *buffer, int bytes, int is_write)
+{
+ int total_bytes = bytes;
+ u8 *buff = buffer;
+ u8 dummy[64 * 4];
+ int count, ret;
+
+ if (addr & 1)
+ fprintf(stderr, "read_write_rom: can't handle odd address %06x, "
+ "LSb will be ignored\n", addr);
+ if (bytes & 63)
+ fprintf(stderr, "read_write_rom: byte count must be multiple of 64, "
+ "last %d bytes will not be handled\n", bytes & 63);
+
+ printf("%s flash ROM...\n", is_write ? "writing to" : "reading");
+
+ /* do i/o in blocks */
+ for (count = 0; bytes >= IO_BLK_SIZE; count++) {
+ print_progress(buff - (u8 *)buffer, total_bytes);
+
+ ret = rw_rom_block(dev, addr, buff, IO_BLK_SIZE, is_write);
+ if (ret < 0)
+ return ret;
+ buff += IO_BLK_SIZE;
+ addr += IO_BLK_SIZE;
+ bytes -= IO_BLK_SIZE;
+ }
+ print_progress(buff - (u8 *)buffer, total_bytes);
+
+ ret = 0;
+ if (bytes != 0) {
+ ret = rw_rom_block(dev, addr, buff, bytes, is_write);
+ count++;
+ print_progress(total_bytes, total_bytes);
+ }
+
+ if (count & 1)
+ /* work around read_rom_block() limitation 3 */
+ rw_rom_block(dev, 0, dummy, sizeof(dummy), 0);
+
+ printf("\n");
+ return ret;
+}
+
+static int increment_erase_cnt(struct usb_dev_handle *dev)
+{
+ dev_cmd_t cmd;
+ u8 buff[4];
+ u32 cnt;
+ int ret;
+
+ ret = read_erase_counter(dev, &cnt);
+ if (ret != 0)
+ return ret;
+
+ if (cnt == (u32)-1) {
+ fprintf(stderr, "flash erase counter maxed out!\n");
+ fprintf(stderr, "(wow, did you really erase so many times?)\n");
+ return -1;
+ }
+
+ cnt++;
+
+ prepare_cmd(&cmd, CMD_ATM_READY);
+ cmd.write_cnt.cmd = W_COUNTER;
+ cmd.write_cnt.action = W_CNT_WRITE;
+ cmd.write_cnt.b3 = cnt >> 24;
+ cmd.write_cnt.b2 = cnt >> 16;
+ cmd.write_cnt.b1 = cnt >> 8;
+ cmd.write_cnt.b0 = cnt;
+
+ ret = write_cmd(dev, &cmd);
+ if (ret < 0)
+ return ret;
+
+ ret = read_data(dev, buff, sizeof(buff));
+ if (ret < 0)
+ return ret;
+
+ return 0;
+}
+
+static int erase_page(struct usb_dev_handle *dev, u32 addr, int whole)