CHIRP

# Quansheng UV-K5 driver (c) 2023 Jacek Lipkowski <sq5bpf@lipkowski.org>

#

# based on template.py Copyright 2012 Dan Smith <dsmith@danplanet.com>

#

#

# This is a preliminary version of a driver for the UV-K5

# It is based on my reverse engineering effort described here:

# https://github.com/sq5bpf/uvk5-reverse-engineering

#

# Warning: this driver is experimental, it may brick your radio,

# eat your lunch and mess up your configuration.

#

#

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 2 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

#

# Adapted partially to IJV firmware v2.9 by Julian Lilov (LZ1JDL)

# http://www.hamskey.com/2024/04/introduction-to-uv-k5-hf-05-fullband.html#more

#

# Adapted full to IJV  by Francesco IK8JHL 

# FIX:  QRA , Beacon/CQ CAll Message, Selettive , TX Enable, PTTID, Squelch A/B, Band TX, Band A/B TX , Singol Band enable,  Satcom , Upconverter etc etc

# eliminatte funzioni non attive nel FW IJV

#

# Adapted partially to CEC firmware v0.5 by KD8CEC

# https://www.universirius.com/en_gb/preppers/quansheng-uv-k5-manuale-del-firmware-ijv/#Firmware-IJV

#

#JH11i

import os

import tempfile

import struct

import logging

from chirp import chirp_common, directory, bitwise, memmap, errors, util

from chirp.settings import RadioSetting, RadioSettingGroup, \

    RadioSettingValueBoolean, RadioSettingValueList, \

    RadioSettingValueInteger, RadioSettingValueString, \

    RadioSettings

LOG = logging.getLogger(__name__)

# Show the obfuscated version of commands. Not needed normally, but

# might be useful for someone who is debugging a similar radio

DEBUG_SHOW_OBFUSCATED_COMMANDS = False

# Show the memory being written/received. Not needed normally, because

# this is the same information as in the packet hexdumps, but

# might be useful for someone debugging some obscure memory issue

DEBUG_SHOW_MEMORY_ACTIONS = True

DEBUG_WRITE_RADIO_HEXDUMP = True

MEM_FORMAT = """

#seekto 0x0000;

struct {

    // 0x00

    u32 freq;

    u32 offset;

    // 0x08

    u8 rx_freq_Code;

    u8 tx_offset_Code;

    struct {

        u8 rx_CodeType:4,

           tx_CodeType:4;

    } tx_rx_CodeType;

    struct {

        u8 TX_OFFSET_FREQUENCY_DIRECTION:4,

           Modulation:4;

    } mod_tx_off;

    struct {

        u8 FrequencyReverse:1,

           CHANNEL_BANDWIDTH:1,

           OUTPUT_POWER:2,

           BUSY_CHANNEL_LOCK:4;

    } bcl_op_cb;

    struct{

        u8 unknown1:1,

        DTMF_PTT_ID_TX_MODE:7;

    } DTMF_PTT_ID_TX_MODE;

    u8 STEP_SETTING;

    u8 SCRAMBLING_TYPE;

} channel[207];

#seekto 0x0D60;

struct {

// ChannelAttributes_t start

    u8 band;

    u8 compander;

    u8 is_scanlist2;

    u8 is_scanlist1;

// end

} channel_attributes[207];

#seekto 0x0E70;

u8 CHAN_1_CALL;

u8 SQUELCH_LEVEL;

u8 TX_TIMEOUT_TIMER;

u8 NOAA_AUTO_SCAN;

u8 KEY_LOCK;

u8 VOX_SWITCH;

u8 VOX_LEVEL;

u8 MIC_SENSITIVITY;

#seekto 0x0E78;

struct {

    u8 BACKLIGHT_MAX:4, BACKLIGHT_MIN:4;

} backlight;

u8 CHANNEL_DISPLAY_MODE;

u8 CROSS_BAND_RX_TX;

u8 BATTERY_SAVE;

u8 DUAL_WATCH;

u8 BACKLIGHT_TIME;

u8 TAIL_TONE_ELIMINATION;

u8 VFO_OPEN;

#seekto 0x0E80;

u8 ScreenChannel_0;

u8 ScreenChannel_1;

u8 MrChannel_0;

u8 MrChannel_1;

u8 FreqChannel_0;

u8 FreqChannel_1;

u8 NoaaChannel_0;

u8 NoaaChannel_1;

#seekto 0x0E90;

struct {

    u8 BEEP_CONTROL:1, KEY_M_LONG_PRESS_ACTION: 7;

} beep_key_long_press;

u8 KEY_1_SHORT_PRESS_ACTION;

u8 KEY_1_LONG_PRESS_ACTION;

u8 KEY_2_SHORT_PRESS_ACTION;

u8 KEY_2_LONG_PRESS_ACTION;

u8 SCAN_RESUME_MODE;

u8 AUTO_KEYPAD_LOCK;

u8 POWER_ON_DISPLAY_MODE;

#seekto 0x0E98;

u32 POWER_ON_PASSWORD;

#seekto 0x0EA0;

u8 VOICE_PROMPT;

u8 S0_LEVEL;

u8 S9_LEVEL;

#seekto 0x0EA8;

u8 ALARM_MODE;

u8 ROGER;

u8 REPEATER_TAIL_TONE_ELIMINATION;

u8 TX_VFO;

u8 BATTERY_TYPE;

#seekto 0x0EB0;

char EEPROM_WELCOMESTRING1[16];

char EEPROM_WELCOMESTRING2[16];

#seekto 0x0ED0;

u8 DTMF_SIDE_TONE;

char DTMF_SEPARATE_CODE;

char DTMF_GROUP_CALL_CODE;

u8 DTMF_DECODE_RESPONSE;

u8 DTMF_auto_reset_time;

u8 DTMF_PRELOAD_TIME;

u8 DTMF_FIRST_CODE_PERSIST_TIME;

u8 DTMF_HASH_CODE_PERSIST_TIME;

u8 DTMF_CODE_PERSIST_TIME;

u8 DTMF_CODE_INTERVAL_TIME;

u8 PERMIT_REMOTE_KILL;

#seekto 0x0EE0;

char ANI_DTMF_ID[8];

#seekto 0x0EE8;

char KILL_CODE[8];

#seekto 0x0EF0;

char REVIVE_CODE[8];

#seekto 0x0EF8;

char DTMF_UP_CODE[16];

#seekto 0x0F08;

char DTMF_DOWN_CODE[16];

#seekto 0x0F18;

u8 SCANLIST_DEFAULT;

u8 SCANLIST1_ENABLED;

u8 SCANLIST1_PRIORITY_CH1;

u8 SCANLIST1_PRIORITY_CH2;

u8 SCANLIST2_ENABLED;

u8 SCANLIST2_PRIORITY_CH1;

u8 SCANLIST2_PRIORITY_CH2;

#seekto 0x0F30;

u8 bHasCustomAesKey;

#seekto 0x0F40;

u8 F_LOCK;

u8 350TX;

u8 KILLED;

u8 200TX;

u8 350EN;

u8 en350;

u8 ScrambleEnable;

struct {

    u8 Setting_TX_EN:1,

       live_DTMF_decoder: 1,

       batery_txt:2,

       micbar:1,

       am_fix:1,

       bl_txrx:2;

} settings_0f40;

#seekto 0x0F50;

struct{

    char name[16];

} channel_name[207];

// CEC_EEPROM_START1

#seekto 0x1D50;

u8 CEC_LiveSeekMode;

u8 CW_KEYTYPE;

u8 CW_SPEED;

u8 CW_TONE;

// DTMF contacts

#seekto 0x1C00;

struct {

    char name[8];

    char number[3];

    char unused_00[5];

} dtmfcontact[16];

"""

# bits that we will save from the channel structure (mostly unknown)

SAVE_MASK_0A = 0b11001100

SAVE_MASK_0B = 0b11101100

SAVE_MASK_0C = 0b11100000

SAVE_MASK_0D = 0b11111000

SAVE_MASK_0E = 0b11110001

SAVE_MASK_0F = 0b11110000

# flags1

FLAGS1_OFFSET_NONE = 0b00

FLAGS1_OFFSET_MINUS = 0b10

FLAGS1_OFFSET_PLUS = 0b01

# flags2

POWER_HIGH = 0b10

POWER_MEDIUM = 0b01

POWER_LOW = 0b00

BANDWIDTH_WIDE = 0b00

BANDWIDTH_WIDE_PLUS = 0b11

BANDWIDTH_NARROW = 0b01

BANDWIDTH_NARROW_MINUS = 0b10

# bandwidth

BANDWIDTH_LIST = ["W", "N"]

# dtmf_flags

PTTID_LIST = ["off", "TX UP", "TX DOWN", "BOTH", "APOLLO" ]

# power

UVK5_POWER_LEVELS = [chirp_common.PowerLevel("Low",  watts=1.00),

                     chirp_common.PowerLevel("Med",  watts=2.50),

                     chirp_common.PowerLevel("High", watts=5.00)

                    ]

# scrambler // TODO Gibt es das in der Firmware?

SCRAMBLER_LIST = ["Off", "2600Hz", "2700Hz", "2800Hz", "2900Hz", "3000Hz", "3100Hz", "3200Hz", "3300Hz", "3400Hz", "3500Hz"]

# channel display mode

CHANNELDISP_LIST = ["Frequency", "Channel No", "Channel Name", "Name_S Freq_L"]

BATSAVE_LIST = ["Off", "50%", "67%", "75%", "80%"]

# compander // nur 0 1 2 als Werte Möglich, siehe bk4819.c Zeile 868

COMPANDER_LIST = ["Off", "TX", "RX"]

# mic gain

MICGAIN_LIST = ["+1.1dB","+4.0dB","+8.0dB","+12.0dB","+15.1dB"]

# Talk Time

TALKTIME_LIST = ["30s","1min","2min","3min","4min","5min","6min","7min","8min","9min","15min"]

# Backlight auto mode

BACKLIGHT_MIN_LIST = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]

BACKLIGHT_MAX_LIST = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]

BACKLIGHT_TX = ["Off", "TX", "RX", "TX/RX"]

# Crossband receiving/transmitting

CROSSBAND_LIST = ["Off", "VFO A", "VFO B"]

DUALWATCH_LIST = ["Off", "VFO A", "VFO B"]

# battery save

BATTERY_SAFE_LIST = ["Off", "1:4", "1:3", "1:2", "1:1"]

# steps

STEPS = [0.01, 0.05, 0.10, 0.25, 0.50, 1.00, 1.25, 2.50, 5.00, 6.25, 8.33, 9.00, 10.00, 12.50, 15.00, 20.00, 25.00, 30.00, 50.00, 100.00, 25.00, 125.00, 200.00, 250.00, 500.00]

# TODO *TCS???

# ctcss/dcs codes

TMODES = ["", "Tone", "DTCS", "DTCS"]

TONE_NONE = 0

TONE_CTCSS = 1

TONE_DCS = 2

TONE_RDCS = 3

CTCSS_TONES = [

    67.0, 69.3, 71.9, 74.4, 77.0, 79.7, 82.5, 85.4,

    88.5, 91.5, 94.8, 97.4, 100.0, 103.5, 107.2, 110.9,

    114.8, 118.8, 123.0, 127.3, 131.8, 136.5, 141.3, 146.2,

    151.4, 156.7, 159.8, 162.2, 165.5, 167.9, 171.3, 173.8,

    177.3, 179.9, 183.5, 186.2, 189.9, 192.8, 196.6, 199.5,

    203.5, 206.5, 210.7, 218.1, 225.7, 229.1, 233.6, 241.8,

    250.3, 254.1

]

# lifted from ft4.py

DTCS_CODES = [

    23,  25,  26,  31,  32,  36,  43,  47,  51,  53,  54,

    65,  71,  72,  73,  74,  114, 115, 116, 122, 125, 131,

    132, 134, 143, 145, 152, 155, 156, 162, 165, 172, 174,

    205, 212, 223, 225, 226, 243, 244, 245, 246, 251, 252,

    255, 261, 263, 265, 266, 271, 274, 306, 311, 315, 325,

    331, 332, 343, 346, 351, 356, 364, 365, 371, 411, 412,

    413, 423, 431, 432, 445, 446, 452, 454, 455, 462, 464,

    465, 466, 503, 506, 516, 523, 526, 532, 546, 565, 606,

    612, 624, 627, 631, 632, 654, 662, 664, 703, 712, 723,

    731, 732, 734, 743, 754

]

# TODO required?

#FLOCK_LIST = ["Off", "FCC", "CE", "GB", "430", "438"]

SCANRESUME_LIST = ["TIME: Resume after 5 seconds",

                   "CARRIER: Resume after signal disappears",

                   "SEARCH: Stop scanning after receiving a signal",

                   "LOG"]

WELCOME_LIST = ["None", "FW Mod", "Message"]

KEYPADTONE_LIST = ["Off", "Chinese", "English"]

LANGUAGE_LIST = ["Chinese", "English"]

ALARMMODE_LIST = ["SITE", "TONE"]

REMENDOFTALK_LIST = ["Off", "Single", "Roger", "MDC 1200", "Apollo Quindar", "Digital Code ID"]

RTE_LIST = ["Off", 

            "1*100ms", "2*100ms", "3*100ms", "4*100ms", "5*100ms",

            "6*100ms", "7*100ms", "8*100ms", "9*100ms", "10*100ms",

            "11*100ms", "12*100ms", "13*100ms", "14*100ms", "15*100ms",

            "16*100ms", "17*100ms", "18*100ms", "19*100ms", "20*100ms"]

MEM_SIZE = 0x2000  # size of all memory

PROG_SIZE = 0x1d00  # size of the memory that we will write

MEM_BLOCK = 0x80  # largest block of memory that we can reliably write

# fm radio supported frequencies

FMMIN = 76.0

FMMAX = 108.0

# bands supported by the UV-K5

BANDS = {

        0: [15.0, 107.9999],

        1: [108.0, 135.9999],

        2: [136.0, 173.9990],

        3: [174.0, 349.9999],

        4: [350.0, 399.9999],

        5: [400.0, 469.9999],

        6: [470.0, 1299.9999]

        }

# for radios with modified firmware:

BANDS_NOLIMITS = {

        0: [15.0, 107.9999],

        1: [108.0, 135.9999],

        2: [136.0, 173.9990],

        3: [174.0, 349.9999],

        4: [350.0, 399.9999],

        5: [400.0, 469.9999],

        6: [470.0, 1299.9999]

        }

SPECIALS = {

        # "VFO A1(15-108)": 200,

        # "VFO B1(15-108)": 201,

        # "VFO A2(108-136)": 202,

        # "VFO B2(108-136)": 203,

        # "VFO A3(136-174)": 204,

        # "VFO B3(136-174)": 205,

        # "VFO A4(174-350)": 206,

        # "VFO B4(174-350)": 207,

        # "VFO A5(350-400)": 208,

        # "VFO B5(350-400)": 209,

        # "VFO A6(400-470)": 210,

        # "VFO B6(400-470)": 211,

        # "VFO A7(470-1300)": 212,

        # "VFO B7(470-1300)": 213

        }

VFO_CHANNEL_NAMES = ["F1(50M-76M)A", "F1(50M-76M)B",

                     "F2(108M-136M)A", "F2(108M-136M)B",

                     "F3(136M-174M)A", "F3(136M-174M)B",

                     "F4(174M-350M)A", "F4(174M-350M)B",

                     "F5(350M-400M)A", "F5(350M-400M)B",

                     "F6(400M-470M)A", "F6(400M-470M)B",

                     "F7(470M-600M)A", "F7(470M-600M)B"]

SCANLIST_LIST = ["None", "1", "2", "1+2"]

DTMF_CHARS = "0123456789ABCD*# "

DTMF_CHARS_ID = "0123456789ABCDabcd#* "

DTMF_CHARS_KILL = "0123456789ABCDabcd"

DTMF_CHARS_UPDOWN = "0123456789ABCDabcd#* "

DTMF_CODE_CHARS = "ABCD*# "

DTMF_DECODE_RESPONSE_LIST = ["None", "Ring", "Reply", "Both"]

KEYACTIONS_LIST = ["None", "Flashlight", "TX Power",

                   "Monitor", "Scan on/off", "VOX on/off",

                   "FM radio on/off", "VFO Change", "VFO Swap", 

                   "SQL +", "SQL -", "REGA Test", "REGA Alarm", "CW Call CQ"]

UPCONV_LIST = ["Off","50", "125"]

# the communication is obfuscated using this fine mechanism

def xorarr(data: bytes):

    tbl = [22, 108, 20, 230, 46, 145, 13, 64, 33, 53, 213, 64, 19, 3, 233, 128]

    x = b""

    r = 0

    for byte in data:

        x += bytes([byte ^ tbl[r]])

        r = (r+1) % len(tbl)

    return x

# if this crc was used for communication to AND from the radio, then it

# would be a measure to increase reliability.

# but it's only used towards the radio, so it's for further obfuscation

def calculate_crc16_xmodem(data: bytes):

    poly = 0x1021

    crc = 0x0

    for byte in data:

        crc = crc ^ (byte << 8)

        for i in range(8):

            crc = crc << 1

            if (crc & 0x10000):

                crc = (crc ^ poly) & 0xFFFF

    return crc & 0xFFFF

def _send_command(serport, data: bytes):

    """Send a command to UV-K5 radio"""

    LOG.debug("Sending command (unobfuscated) len=0x%4.4x:\n%s" %

              (len(data), util.hexprint(data)))

    crc = calculate_crc16_xmodem(data)

    data2 = data + struct.pack("<H", crc)

    command = struct.pack(">HBB", 0xabcd, len(data), 0) + \

        xorarr(data2) + \

        struct.pack(">H", 0xdcba)

    if DEBUG_SHOW_OBFUSCATED_COMMANDS:

        LOG.debug("Sending command (obfuscated):\n%s" % util.hexprint(command))

    try:

        result = serport.write(command)

    except Exception:

        raise errors.RadioError("Error writing data to radio")

    return result

def _receive_reply(serport):

    header = serport.read(4)

    if len(header) != 4:

        LOG.warning("Header short read: [%s] len=%i" %

                    (util.hexprint(header), len(header)))

        raise errors.RadioError("Header short read")

    if header[0] != 0xAB or header[1] != 0xCD or header[3] != 0x00:

        LOG.warning("Bad response header: %s len=%i" %

                    (util.hexprint(header), len(header)))

        raise errors.RadioError("Bad response header")

    cmd = serport.read(int(header[2]))

    if len(cmd) != int(header[2]):

        LOG.warning("Body short read: [%s] len=%i" %

                    (util.hexprint(cmd), len(cmd)))

        raise errors.RadioError("Command body short read")

    footer = serport.read(4)

    if len(footer) != 4:

        LOG.warning("Footer short read: [%s] len=%i" %

                    (util.hexprint(footer), len(footer)))

        raise errors.RadioError("Footer short read")

    if footer[2] != 0xDC or footer[3] != 0xBA:

        LOG.debug(

                "Reply before bad response footer (obfuscated)"

                "len=0x%4.4x:\n%s" % (len(cmd), util.hexprint(cmd)))

        LOG.warning("Bad response footer: %s len=%i" %

                    (util.hexprint(footer), len(footer)))

        raise errors.RadioError("Bad response footer")

    if DEBUG_SHOW_OBFUSCATED_COMMANDS:

        LOG.debug("Received reply (obfuscated) len=0x%4.4x:\n%s" %

                  (len(cmd), util.hexprint(cmd)))

    cmd2 = xorarr(cmd)

    LOG.debug("Received reply (unobfuscated) len=0x%4.4x:\n%s" %

              (len(cmd2), util.hexprint(cmd2)))

    return cmd2

def _getstring(data: bytes, begin, maxlen):

    tmplen = min(maxlen+1, len(data))

    s = [data[i] for i in range(begin, tmplen)]

    for key, val in enumerate(s):

        if val < ord(' ') or val > ord('~'):

            break

    return ''.join(chr(x) for x in s[0:key])

def _sayhello(serport):

    hellopacket = b"\x14\x05\x04\x00\x6a\x39\x57\x64"

    tries = 5

    while True:

        LOG.debug("Sending hello packet")

        _send_command(serport, hellopacket)

        o = _receive_reply(serport)

        if (o):

            break

        tries -= 1

        if tries == 0:

            LOG.warning("Failed to initialise radio")

            raise errors.RadioError("Failed to initialize radio")

    firmware = _getstring(o, 4, 16)

    LOG.info("Found firmware: %s" % firmware)

    return firmware

def _readmem(serport, offset, length):

    LOG.debug("Sending readmem offset=0x%4.4x len=0x%4.4x" % (offset, length))

    readmem = b"\x1b\x05\x08\x00" + \

        struct.pack("<HBB", offset, length, 0) + \

        b"\x6a\x39\x57\x64"

    _send_command(serport, readmem)

    o = _receive_reply(serport)

    if DEBUG_SHOW_MEMORY_ACTIONS:

        LOG.debug("readmem Received data len=0x%4.4x:\n%s" %

                  (len(o), util.hexprint(o)))

    return o[8:]

def _writemem(serport, data, offset):

    LOG.debug("Sending writemem offset=0x%4.4x len=0x%4.4x" %

              (offset, len(data)))

    if DEBUG_SHOW_MEMORY_ACTIONS:

        LOG.debug("writemem sent data offset=0x%4.4x len=0x%4.4x:\n%s" %

                  (offset, len(data), util.hexprint(data)))

    dlen = len(data)

    writemem = b"\x1d\x05" + \

        struct.pack("<BBHBB", dlen+8, 0, offset, dlen, 1) + \

        b"\x6a\x39\x57\x64"+data

    _send_command(serport, writemem)

    o = _receive_reply(serport)

    LOG.debug("writemem Received data: %s len=%i" % (util.hexprint(o), len(o)))

    if (o[0] == 0x1e

            and

            o[4] == (offset & 0xff)

            and

            o[5] == (offset >> 8) & 0xff):

        return True

    else:

        LOG.warning("Bad data from writemem")

        raise errors.RadioError("Bad response to writemem")

def _resetradio(serport):

    resetpacket = b"\xdd\x05\x00\x00"

    _send_command(serport, resetpacket)

def do_download(radio):

    serport = radio.pipe

    serport.timeout = 0.5

    status = chirp_common.Status()

    status.cur = 0

    status.max = MEM_SIZE

    status.msg = "Downloading from radio"

    radio.status_fn(status)

    eeprom = b""

    f = _sayhello(serport)

    if f:

        radio.FIRMWARE_VERSION = f

    else:

        raise errors.RadioError('Unable to determine firmware version')

    addr = 0

    while addr < MEM_SIZE:

        o = _readmem(serport, addr, MEM_BLOCK)

        status.cur = addr

        radio.status_fn(status)

        if o and len(o) == MEM_BLOCK:

            eeprom += o

            addr += MEM_BLOCK

        else:

            raise errors.RadioError("Memory download incomplete")

    if DEBUG_WRITE_RADIO_HEXDUMP:

        hex_data = _convert_to_intel_hex(eeprom)

        _save_to_hex_file(hex_data, os.path.join(tempfile.gettempdir(), "radio_dump.hex"))

    return memmap.MemoryMapBytes(eeprom)

def _convert_to_intel_hex(data):

    hex_data = ""

    for i in range(0, len(data), 16):

        chunk = data[i:i+16]

        hex_data += ":"

        hex_data += format(len(chunk), "02X")

        hex_data += format(i >> 8, "04X")

        hex_data += format(i & 0xFF, "02X")

        hex_data += "00"

        for byte in chunk:

            hex_data += format(byte, "02X")

        checksum = (len(chunk) + (i >> 8) + (i & 0xFF)) & 0xFF

        checksum = ((~checksum) + 1) & 0xFF

        hex_data += format(checksum, "02X")

        hex_data += "\n"

    hex_data += ":00000001FF"  # End of file record

    return hex_data

def _save_to_hex_file(data, filename):

    with open(filename, "w") as f:

        f.write(data)

def do_upload(radio):

    serport = radio.pipe

    serport.timeout = 0.5

    status = chirp_common.Status()

    status.cur = 0

    status.max = PROG_SIZE

    status.msg = "Uploading to radio"

    radio.status_fn(status)

    f = _sayhello(serport)

    if f:

        radio.FIRMWARE_VERSION = f

    else:

        return False

    addr = 0

    while addr < PROG_SIZE:

        o = radio.get_mmap()[addr:addr+MEM_BLOCK]

        _writemem(serport, o, addr)

        status.cur = addr

        radio.status_fn(status)

        if o:

            addr += MEM_BLOCK

        else:

            raise errors.RadioError("Memory upload incomplete")

    status.msg = "Uploaded OK"

    _resetradio(serport)

    return True

def _find_band(nolimits, hz):

    mhz = hz/1000000.0

    if nolimits:

        B = BANDS_NOLIMITS

    else:

        B = BANDS

    # currently the hacked firmware sets band=1 below 50 MHz

    if nolimits and mhz < 50.0:

        return 1

    for a in B:

        if mhz >= B[a][0] and mhz <= B[a][1]:

            return a

    return False

@directory.register

class UVK5Radio(chirp_common.CloneModeRadio):

    """Quansheng UV-K5"""

    VENDOR = "Quansheng"

    MODEL = "UV-K5-CEC"

    BAUD_RATE = 38400

    NEEDS_COMPAT_SERIAL = False

    FIRMWARE_VERSION = ""

    _expanded_limits = True

    def get_prompts(x=None):

        rp = chirp_common.RadioPrompts()

        rp.experimental = _(

            'This is an experimental driver for the Quansheng UV-K5. '

            'It may harm your radio, or worse. Use at your own risk.\n\n'

            'Before attempting to do any changes please download '

            'the memory image from the radio with chirp '

            'and keep it. This can be later used to recover the '

            'original settings. \n\n'

            'some details are not yet implemented')

        rp.pre_download = _(

            "1. Turn radio on.\n"

            "2. Connect cable to mic/spkr connector.\n"

            "3. Make sure connector is firmly connected.\n"

            "4. Click OK to download image from device.\n\n"

            "It will may not work if you turn on the radio "

            "with the cable already attached\n")

        rp.pre_upload = _(

            "1. Turn radio on.\n"

            "2. Connect cable to mic/spkr connector.\n"

            "3. Make sure connector is firmly connected.\n"

            "4. Click OK to upload the image to device.\n\n"

            "It will may not work if you turn on the radio "

            "with the cable already attached")

        return rp

    # Return information about this radio's features, including

    # how many memories it has, what bands it supports, etc

    def get_features(self):

        rf = chirp_common.RadioFeatures()

        rf.has_bank = False

        rf.valid_dtcs_codes = DTCS_CODES

        rf.has_rx_dtcs = True

        rf.has_ctone = True

        rf.has_settings = True

        rf.has_comment = False

        rf.valid_name_length = 10

        rf.valid_power_levels = UVK5_POWER_LEVELS

        rf.valid_special_chans = list(SPECIALS.keys())

        rf.valid_duplexes = ["", "-", "+", "off"]

        # hack so we can input any frequency,

        # the 0.1 and 0.01 steps don't work unfortunately

        # rf.valid_tuning_steps = [0.01, 0.1, 1.0] + STEPS

        rf.valid_tuning_steps = STEPS

        rf.valid_tmodes = ["", "Tone", "TSQL", "DTCS", "Cross"]

        rf.valid_cross_modes = ["Tone->Tone", "Tone->DTCS", "DTCS->Tone",

                                "->Tone", "->DTCS", "DTCS->", "DTCS->DTCS"]

        rf.valid_characters = chirp_common.CHARSET_ASCII

        rf.valid_modes = ["FM", "AM", "USB", "CW"]

        rf.valid_skips = [""]

        # This radio supports memories 1-200, 201-214 are the VFO memories

        rf.memory_bounds = (1, 200)

        rf.valid_bands = []

        for a in BANDS_NOLIMITS:

            rf.valid_bands.append(

                    (int(BANDS_NOLIMITS[a][0]*1000000),

                     int(BANDS_NOLIMITS[a][1]*1000000)))

        return rf

    # Do a download of the radio from the serial port

    def sync_in(self):

        self._mmap = do_download(self)

        self.process_mmap()

    # Do an upload of the radio to the serial port

    def sync_out(self):

        do_upload(self)

    # Convert the raw byte array into a memory object structure

    def process_mmap(self):

        self._memobj = bitwise.parse(MEM_FORMAT, self._mmap)

    # Return a raw representation of the memory object, which

    # is very helpful for development

    def get_raw_memory(self, number):

        return repr(self._memobj.channel[number-1])

    def validate_memory(self, mem):

        msgs = super().validate_memory(mem)

        if mem.duplex == 'off':

            return msgs

        # find tx frequency

        if mem.duplex == '-':

            txfreq = mem.freq - mem.offset

        elif mem.duplex == '+':

            txfreq = mem.freq + mem.offset

        else:

            txfreq = mem.freq

        # find band

        band = _find_band(self._expanded_limits, txfreq)

        if band is False:

            msg = "Transmit frequency %.4f MHz is not supported by this radio"\

                   % (txfreq/1000000.0)

            msgs.append(chirp_common.ValidationError(msg))

        band = _find_band(self._expanded_limits, mem.freq)

        if band is False:

            msg = "The frequency %.4f MHz is not supported by this radio" \

                   % (mem.freq/1000000.0)

            msgs.append(chirp_common.ValidationError(msg))

        return msgs

    def _set_tone(self, mem, _mem):

        ((txmode, txtone, txpol),

         (rxmode, rxtone, rxpol)) = chirp_common.split_tone_encode(mem)

        if txmode == "Tone":

            txtoval = CTCSS_TONES.index(txtone)

            txmoval = 0b01

        elif txmode == "DTCS":

            txmoval = txpol == "R" and 0b11 or 0b10

            txtoval = DTCS_CODES.index(txtone)

        else:

            txmoval = 0

            txtoval = 0

        if rxmode == "Tone":

            rxtoval = CTCSS_TONES.index(rxtone)

            rxmoval = 0b01

        elif rxmode == "DTCS":

            rxmoval = rxpol == "R" and 0b11 or 0b10

            rxtoval = DTCS_CODES.index(rxtone)

        else:

            rxmoval = 0

            rxtoval = 0

        _mem.rxcodeflag = rxmoval

        _mem.txcodeflag = txmoval

        _mem.unknown1 = 0

        _mem.unknown2 = 0

        _mem.rxcode = rxtoval

        _mem.txcode = txtoval

    def _get_tone(self, mem, _mem):

        rxtype = _mem.rxcodeflag

        txtype = _mem.txcodeflag

        rx_tmode = TMODES[rxtype]

        tx_tmode = TMODES[txtype]

        rx_tone = tx_tone = None

        if tx_tmode == "Tone":

            if _mem.txcode < len(CTCSS_TONES):

                tx_tone = CTCSS_TONES[_mem.txcode]

            else:

                tx_tone = 0

                tx_tmode = ""

        elif tx_tmode == "DTCS":

            if _mem.txcode < len(DTCS_CODES):