--- gobi_loader.c	2009-04-04 20:36:19.000000000 +0200
+++ gobi_loader.c	2010-02-13 10:16:35.542254191 +0100
@@ -1,5 +1,7 @@
 /* Firmware loader for Qualcomm Gobi USB hardware */
 
+/* Modified/Slightly rewritten by Madox <madox@madox.net> */
+
 /* Copyright 2009 Red Hat <mjg@redhat.com> - heavily based on work done by
  * Alexander Shumakovitch <shurik@gwu.edu>
  *
@@ -26,27 +28,19 @@
 #include <unistd.h>
 #include <malloc.h>
 
-char magic1[] = {0x01, 0x51, 0x43, 0x4f, 0x4d, 0x20, 0x68, 0x69,
+char cmd_devinit[] = {0x01, 0x51, 0x43, 0x4f, 0x4d, 0x20, 0x68, 0x69,
 		 0x67, 0x68, 0x20, 0x73, 0x70, 0x65, 0x65, 0x64, 0x20, 
 		 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x20,
 		 0x68, 0x73, 0x74, 0x00, 0x00, 0x00, 0x00, 0x04, 0x04,
 		 0x30, 0xff, 0xff};
 
-//char magic1[] = "QCOM high speed protocol hst\0\0\0\0\x04\x04\x30";
-
-char magic2[] = {0x25, 0x05, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
-		 0x00, 0x00, 0x04, 0x00, 0x00, 0xff, 0xff};
-
-char magic3[] = {0x27, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-		 0x00, 0x00, 0xff, 0xff};
-
-char magic4[] = {0x25, 0x06, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
-		 0x00, 0x00, 0x04, 0x00, 0x00, 0xff, 0xff};
-
-char magic5[] = {0x27, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-		 0x00, 0x00, 0xff, 0xff};
-
-char magic6[] = {0x29, 0xff, 0xff};
+char cmd_devinit2k[] = {0x01, 0x51, 0x43, 0x4f, 0x4d, 0x20, 0x68, 0x69,
+		 0x67, 0x68, 0x20, 0x73, 0x70, 0x65, 0x65, 0x64, 0x20, 
+		 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x20,
+		 0x68, 0x73, 0x74, 0x00, 0x00, 0x00, 0x00, 0x05, 0x05,
+		 0x30, 0xff, 0xff};
+     
+char cmd_complete[] = {0x29, 0xff, 0xff};
 
 /*
  * This mysterious table is just the CRC of each possible byte. It can be
@@ -101,6 +95,7 @@
  *	@buffer: data pointer
  *	@len: number of bytes in the buffer
  */
+
 unsigned short crc_ccitt(short crc, char const *buffer, size_t len)
 {
 	while (len--)
@@ -108,29 +103,136 @@
 	return crc;
 }
 
-void usage (char **argv) {
+void usage (char **argv)
+{
 	printf ("usage: %s serial_device firmware_dir\n", argv[0]);
 }
 
-int main(int argc, char **argv) {	
-	int serialfd;
+void printhexstring (char *string, int len) {
+  int i;
+  for(i=0; i<len; i++) {
+    printf("%02x ", (unsigned char)*(string+i));
+    if((i+1)%16==0) {
+      printf("\n");
+    }
+  }
+  printf("\n");
+}
+
+int send_firmware(char fwtype, char *filename, int serialfd)
+{
 	int fwfd;
-	int len;
+  char *fwdata = malloc(1024*1024);
+  int fwsize;
+  int len;
+  
+  struct stat file_data;
+  
+  char qdlresp[1024];
+  int qdlresplen;
+  
+  if (!fwdata) {
+		fprintf(stderr, "Failed to allocate memory for firmware\n");
+		return -1;
+	}
+  
+  //QCOM Commands
+  char cmd_sendprep[] = {0x25, 0x05, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0xff, 0xff};
+  char cmd_sendinit[] = {0x27, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff};
+  
+  //Load firmware file
+  fwfd = open(filename, O_RDONLY);
+	     
+	if (fwfd == -1) {
+    if ( fwtype == 0x0D ) {
+      //UQCN firmware file may not exist for older devices
+      printf("UQCN Firmware not file, assuming not Gobi2000...");
+    } else {
+      perror("Failed to open firmware: ");
+      return -1;
+    }
+	}
+  
+  fstat(fwfd, &file_data);
+  
+  if (fwtype == 0x05) {
+    //Quirk, first firmware file (0x05) has last 8 bytes truncated
+    fwsize=file_data.st_size-8; 
+  } else {
+    fwsize=file_data.st_size;
+  }
+  
+  //Fill out firmware type and size
+  cmd_sendprep[1] = fwtype;
+  *(int *)&cmd_sendprep[2] = fwsize;
+  *(int *)&cmd_sendinit[7] = fwsize;
+  
+  //Calculate and fill out CRCs
+  *(short *)&cmd_sendprep[sizeof(cmd_sendprep)-2] =
+		~crc_ccitt(0xffff, cmd_sendprep, sizeof(cmd_sendprep)-2);
+	*(short *)&cmd_sendinit[sizeof(cmd_sendinit)-2] =
+		~crc_ccitt(0xffff, cmd_sendinit, sizeof(cmd_sendinit)-2);
+
+  //Send commands, note the send prep needs to be wrapped by 0x7E
+	write (serialfd, "\x7e", 1);
+	write (serialfd, cmd_sendprep, sizeof(cmd_sendprep));
+	write (serialfd, "\x7e", 1);
+  
+  printf("QDL protocol server request sent\n");
+  printhexstring(cmd_sendprep, sizeof(cmd_sendprep));
+  
+  qdlresplen = read (serialfd, qdlresp, 1024);
+  printf("QDL protocol server response received\n");  
+  printhexstring(qdlresp, qdlresplen);  
+  
+	write (serialfd, cmd_sendinit, sizeof(cmd_sendinit));
+  
+  printf("QDL protocol server request sent\n");
+  printhexstring(cmd_sendinit, sizeof(cmd_sendinit));    
+
+  //Send the firmware file in 1 MiB chunks
+	while (1) {
+		len = read (fwfd, fwdata, 1024*1024);
+		if (len == 1024*1024) {
+			write (serialfd, fwdata, 1024*1024);
+      printf("QDL protocol server sent %d bytes of image\n", 1024*1024); 
+		} else {
+      if (fwtype == 0x05) {
+        //Quirk, first firmware file (0x05) has last 8 bytes truncated
+        write (serialfd, fwdata, len-8);
+        printf("QDL protocol server sent %d bytes of image\n", len-8); 
+      } else {
+        write (serialfd, fwdata, len);
+        printf("QDL protocol server sent %d bytes of image\n", len); 
+      }
+			break;
+		}
+		write (serialfd, fwdata, 0);
+	}
+  
+  sleep(1);
+  
+  qdlresplen = read (serialfd, qdlresp, 1024);
+  printf("QDL protocol server response received\n");  
+  printhexstring(qdlresp, qdlresplen);    
+  
+  return 0;
+}
+
+int main(int argc, char **argv)
+{	
+	int serialfd;
 	int err;
 	struct termios terminal_data;
-	struct stat file_data;
-	char *fwdata = malloc(1024*1024);
-
+  
+  char qdlresp[1024];
+  int qdlresplen;
+  
 	if (argc != 3) {
 		usage(argv);
 		return -1;
 	}
 
-	if (!fwdata) {
-		fprintf(stderr, "Failed to allocate memory for firmware\n");
-		return -1;
-	}
-
 	serialfd = open(argv[1], O_RDWR);
 
 	if (serialfd == -1) {
@@ -146,89 +248,67 @@
 		return -1;
 	}
 
-	fwfd = open("amss.mbn", O_RDONLY);
-
-	if (fwfd == -1) {
-		perror("Failed to open firmware: ");
-		usage(argv);
-		return -1;
-	}
-
-	fstat(fwfd, &file_data);
-	*(int *)&magic2[2] = file_data.st_size - 8;
-	*(int *)&magic3[7] = file_data.st_size - 8;
-	*(short *)&magic1[sizeof(magic1)-2] =
-		~crc_ccitt(0xffff, magic1, sizeof(magic1)-2);
-	*(short *)&magic2[sizeof(magic2)-2] =
-		~crc_ccitt(0xffff, magic2, sizeof(magic2)-2);
-	*(short *)&magic3[sizeof(magic3)-2] =
-		~crc_ccitt(0xffff, magic3, sizeof(magic3)-2);
-
+  //Prepare Serial Port
 	tcgetattr (serialfd, &terminal_data);
 	cfmakeraw (&terminal_data);
 	tcsetattr (serialfd, TCSANOW, &terminal_data);
-
-	write (serialfd, "\x7e", 1);
-	write (serialfd, magic1, sizeof(magic1));
-	write (serialfd, "\x7e", 1);
-
-	write (serialfd, "\x7e", 1);
-	write (serialfd, magic2, sizeof(magic2));
-	write (serialfd, "\x7e", 1);
-
-	write (serialfd, magic3, sizeof(magic3));
-
-	while (1) {
-		len = read (fwfd, fwdata, 1024*1024);
-		if (len == 1024*1024)
-			write (serialfd, fwdata, 1024*1024);
-		else {
-			write (serialfd, fwdata, len-8);
-			break;
-		}
-		write (serialfd, fwdata, 0);
-	}
-
-	fwfd = open("apps.mbn", O_RDONLY);
-
-	if (fwfd == -1) {
-		perror("Failed to open secondary firmware: ");
-		usage(argv);
-		return -1;
-	}
-
-	fstat(fwfd, &file_data);
-	*(int *)&magic4[2] = file_data.st_size;
-	*(int *)&magic5[7] = file_data.st_size;
-
-	*(short *)&magic4[sizeof(magic4)-2] =
-		~crc_ccitt(0xffff, magic4, sizeof(magic4)-2);
-	*(short *)&magic5[sizeof(magic5)-2] =
-		~crc_ccitt(0xffff, magic5, sizeof(magic5)-2);
-
+  
+  //Init the device
+	*(short *)&cmd_devinit[sizeof(cmd_devinit)-2] =
+		~crc_ccitt(0xffff, cmd_devinit, sizeof(cmd_devinit)-2);
+  *(short *)&cmd_devinit2k[sizeof(cmd_devinit2k)-2] =
+		~crc_ccitt(0xffff, cmd_devinit2k, sizeof(cmd_devinit2k)-2);    
 	write (serialfd, "\x7e", 1);
-	write (serialfd, magic4, sizeof(magic4));
+	write (serialfd, cmd_devinit, sizeof(cmd_devinit));
 	write (serialfd, "\x7e", 1);
-
-	write (serialfd, magic5, sizeof(magic5));
-
-	while (1) {
-		len = read (fwfd, fwdata, 1024*1024);
-		if (len == 1024*1024)
-			write (serialfd, fwdata, 1024*1024);
-		else {
-			write (serialfd, fwdata, len);
-			break;
-		}
-		write (serialfd, fwdata, 0);
-	}
-
-	*(short *)&magic6[sizeof(magic6)-2] =
-		~crc_ccitt(0xffff, magic6, sizeof(magic6)-2);
+  
+  printf("QDL protocol server request sent\n");
+  printhexstring(cmd_devinit, sizeof(cmd_devinit));
+  
+  sleep(1);
+  qdlresplen = read (serialfd, qdlresp, 1024);
+  printf("QDL protocol server response received\n");  
+  printhexstring(qdlresp, qdlresplen);
+
+  while(qdlresp[1] == 0x0d || qdlresplen == 0){
+    //Failed, keep retrying with 2k init string
+   	write (serialfd, "\x7e", 1);
+    write (serialfd, cmd_devinit2k, sizeof(cmd_devinit2k));
+    write (serialfd, "\x7e", 1);
+    printf("QDL protocol server request sent (Retry as gobi2000)\n");
+    printhexstring(cmd_devinit2k, sizeof(cmd_devinit2k));
+    qdlresplen = read (serialfd, qdlresp, 1024);
+    printf("QDL protocol server response received (Retry as gobi2000)\n");  
+    printhexstring(qdlresp, qdlresplen);
+    sleep(1);
+  }
+
+  //Send the firmware files
+  err = send_firmware(0x05, "amss.mbn", serialfd);
+  if (err) {
+    perror("Error loading primary firmware.");
+  }
+  err = send_firmware(0x06, "apps.mbn", serialfd);
+  if (err) {
+    perror("Error loading secondary firmware.");
+  }
+  err = send_firmware(0x0D, "UQCN.mbn", serialfd);
+  if (err) {
+    perror("Error loading tertiary firmware.");
+  }
+    
+  //Complete the load
+	*(short *)&cmd_complete[sizeof(cmd_complete)-2] =
+		~crc_ccitt(0xffff, cmd_complete, sizeof(cmd_complete)-2);
 
 	write (serialfd, "\x7e", 1);
-	write (serialfd, magic6, sizeof(magic6));
+	write (serialfd, cmd_complete, sizeof(cmd_complete));
 	write (serialfd, "\x7e", 1);
+  
+  printf("QDL protocol server request sent\n");
+  printhexstring(cmd_complete, sizeof(cmd_complete));
+  
+  printf("Firmware Loading Complete\n");
 
 	return 0;
 }