2 * Boot a Marvell SoC, with Xmodem over UART0.
3 * supports Kirkwood, Dove, Armada 370, Armada XP
5 * (c) 2012 Daniel Stodden <daniel.stodden@gmail.com>
7 * References: marvell.com, "88F6180, 88F6190, 88F6192, and 88F6281
8 * Integrated Controller: Functional Specifications" December 2,
9 * 2008. Chapter 24.2 "BootROM Firmware".
31 * Marvell BootROM UART Sensing
34 static unsigned char kwboot_msg_boot[] = {
35 0xBB, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77
38 static unsigned char kwboot_msg_debug[] = {
39 0xDD, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77
42 /* Defines known to work on Kirkwood */
43 #define KWBOOT_MSG_REQ_DELAY 10 /* ms */
44 #define KWBOOT_MSG_RSP_TIMEO 50 /* ms */
46 /* Defines known to work on Armada XP */
47 #define KWBOOT_MSG_REQ_DELAY_AXP 1000 /* ms */
48 #define KWBOOT_MSG_RSP_TIMEO_AXP 1000 /* ms */
54 #define SOH 1 /* sender start of block header */
55 #define EOT 4 /* sender end of block transfer */
56 #define ACK 6 /* target block ack */
57 #define NAK 21 /* target block negative ack */
58 #define CAN 24 /* target/sender transfer cancellation */
60 #define KWBOOT_XM_BLKSZ 128 /* xmodem block size */
66 uint8_t data[KWBOOT_XM_BLKSZ];
70 #define KWBOOT_BLK_RSP_TIMEO 1000 /* ms */
71 #define KWBOOT_HDR_RSP_TIMEO 10000 /* ms */
73 static int kwboot_verbose;
75 static int msg_req_delay = KWBOOT_MSG_REQ_DELAY;
76 static int msg_rsp_timeo = KWBOOT_MSG_RSP_TIMEO;
77 static int blk_rsp_timeo = KWBOOT_BLK_RSP_TIMEO;
80 kwboot_write(int fd, const char *buf, size_t len)
85 ssize_t wr = write(fd, buf + tot, len - tot);
97 kwboot_printv(const char *fmt, ...)
101 if (kwboot_verbose) {
112 const char seq[] = { '-', '\\', '|', '/' };
114 static int state, bs;
116 if (state % div == 0) {
118 fputc(seq[state / div % sizeof(seq)], stdout);
134 __progress(int pct, char c)
136 const int width = 70;
137 static const char *nl = "";
140 if (pos % width == 0)
141 printf("%s%3d %% [", nl, pct);
146 pos = (pos + 1) % width;
149 while (pos && pos++ < width)
161 kwboot_progress(int _pct, char c)
176 kwboot_tty_recv(int fd, void *buf, size_t len, int timeo)
189 tv.tv_usec = timeo * 1000;
190 if (tv.tv_usec > 1000000) {
191 tv.tv_sec += tv.tv_usec / 1000000;
192 tv.tv_usec %= 1000000;
196 nfds = select(fd + 1, &rfds, NULL, NULL, &tv);
204 n = read(fd, buf, len);
208 buf = (char *)buf + n;
218 kwboot_tty_send(int fd, const void *buf, size_t len)
223 if (kwboot_write(fd, buf, len) < 0)
230 kwboot_tty_send_char(int fd, unsigned char c)
232 return kwboot_tty_send(fd, &c, 1);
236 kwboot_tty_speed(int baudrate)
255 kwboot_open_tty(const char *path, speed_t speed)
262 fd = open(path, O_RDWR|O_NOCTTY|O_NDELAY);
266 memset(&tio, 0, sizeof(tio));
269 tio.c_cflag = CREAD|CLOCAL|CS8;
272 tio.c_cc[VTIME] = 10;
274 cfsetospeed(&tio, speed);
275 cfsetispeed(&tio, speed);
277 rc = tcsetattr(fd, TCSANOW, &tio);
292 kwboot_bootmsg(int tty, void *msg)
299 kwboot_printv("Please reboot the target into UART boot mode...");
301 kwboot_printv("Sending boot message. Please reboot the target...");
304 rc = tcflush(tty, TCIOFLUSH);
308 for (count = 0; count < 128; count++) {
309 rc = kwboot_tty_send(tty, msg, 8);
311 usleep(msg_req_delay * 1000);
316 rc = kwboot_tty_recv(tty, &c, 1, msg_rsp_timeo);
320 } while (rc || c != NAK);
328 kwboot_debugmsg(int tty, void *msg)
332 kwboot_printv("Sending debug message. Please reboot the target...");
337 rc = tcflush(tty, TCIOFLUSH);
341 rc = kwboot_tty_send(tty, msg, 8);
343 usleep(msg_req_delay * 1000);
347 rc = kwboot_tty_recv(tty, buf, 16, msg_rsp_timeo);
359 kwboot_xm_makeblock(struct kwboot_block *block, const void *data,
360 size_t size, int pnum)
366 block->_pnum = ~block->pnum;
368 n = size < KWBOOT_XM_BLKSZ ? size : KWBOOT_XM_BLKSZ;
369 memcpy(&block->data[0], data, n);
370 memset(&block->data[n], 0, KWBOOT_XM_BLKSZ - n);
373 for (i = 0; i < n; i++)
374 block->csum += block->data[i];
384 if (clock_gettime(CLOCK_MONOTONIC, &ts)) {
385 static int err_print;
388 perror("clock_gettime() does not work");
392 /* this will just make the timeout not work */
396 return ts.tv_sec * 1000ULL + (ts.tv_nsec + 500000) / 1000000;
402 return c == ACK || c == NAK || c == CAN;
406 _xm_reply_to_error(int c)
429 kwboot_xm_recv_reply(int fd, char *c, int allow_non_xm, int *non_xm_print)
431 int timeout = allow_non_xm ? KWBOOT_HDR_RSP_TIMEO : blk_rsp_timeo;
432 uint64_t recv_until = _now() + timeout;
439 rc = kwboot_tty_recv(fd, c, 1, timeout);
441 if (errno != ETIMEDOUT)
443 else if (allow_non_xm && *non_xm_print)
449 /* If received xmodem reply, end. */
450 if (_is_xm_reply(*c))
454 * If printing non-xmodem text output is allowed and such a byte
455 * was received, print it and increase receiving time.
456 * Otherwise decrease timeout by time elapsed.
459 recv_until = _now() + timeout;
464 timeout = recv_until - _now();
476 kwboot_xm_sendblock(int fd, struct kwboot_block *block, int allow_non_xm,
487 rc = kwboot_tty_send(fd, block, sizeof(*block));
491 if (allow_non_xm && !*done_print) {
492 kwboot_progress(100, '.');
493 kwboot_printv("Done\n");
497 rc = kwboot_xm_recv_reply(fd, &c, allow_non_xm, &non_xm_print);
501 if (!allow_non_xm && c != ACK)
502 kwboot_progress(-1, '+');
503 } while (c == NAK && retries-- > 0);
508 return _xm_reply_to_error(c);
512 kwboot_xm_finish(int fd)
517 kwboot_printv("Finishing transfer\n");
521 rc = kwboot_tty_send_char(fd, EOT);
525 rc = kwboot_xm_recv_reply(fd, &c, 0, NULL);
528 } while (c == NAK && retries-- > 0);
530 return _xm_reply_to_error(c);
534 kwboot_xmodem_one(int tty, int *pnum, int header, const uint8_t *data,
541 kwboot_printv("Sending boot image %s (%zu bytes)...\n",
542 header ? "header" : "data", size);
547 while (sent < size) {
548 struct kwboot_block block;
552 blksz = kwboot_xm_makeblock(&block, data, left, (*pnum)++);
555 last_block = (left <= blksz);
557 rc = kwboot_xm_sendblock(tty, &block, header && last_block,
566 kwboot_progress(sent * 100 / size, '.');
570 kwboot_printv("Done\n");
579 kwboot_xmodem(int tty, const void *_img, size_t size)
581 const uint8_t *img = _img;
585 hdrsz = kwbheader_size(img);
587 kwboot_printv("Waiting 2s and flushing tty\n");
588 sleep(2); /* flush isn't effective without it */
589 tcflush(tty, TCIOFLUSH);
593 rc = kwboot_xmodem_one(tty, &pnum, 1, img, hdrsz);
600 rc = kwboot_xmodem_one(tty, &pnum, 0, img, size);
604 return kwboot_xm_finish(tty);
608 kwboot_term_pipe(int in, int out, const char *quit, int *s)
611 char _buf[128], *buf = _buf;
613 nin = read(in, buf, sizeof(_buf));
620 for (i = 0; i < nin; i++) {
621 if (*buf == quit[*s]) {
628 if (kwboot_write(out, quit, *s) < 0)
635 if (kwboot_write(out, buf, nin) < 0)
642 kwboot_terminal(int tty)
645 const char *quit = "\34c";
646 struct termios otio, tio;
652 rc = tcgetattr(in, &otio);
656 rc = tcsetattr(in, TCSANOW, &tio);
663 kwboot_printv("[Type Ctrl-%c + %c to quit]\r\n",
664 quit[0]|0100, quit[1]);
676 nfds = nfds < tty ? tty : nfds;
680 nfds = nfds < in ? in : nfds;
683 nfds = select(nfds + 1, &rfds, NULL, NULL, NULL);
687 if (FD_ISSET(tty, &rfds)) {
688 rc = kwboot_term_pipe(tty, STDOUT_FILENO, NULL, NULL);
693 if (in >= 0 && FD_ISSET(in, &rfds)) {
694 rc = kwboot_term_pipe(in, tty, quit, &s);
698 } while (quit[s] != 0);
701 tcsetattr(in, TCSANOW, &otio);
708 kwboot_read_image(const char *path, size_t *size, size_t reserve)
718 fd = open(path, O_RDONLY);
726 img = malloc(st.st_size + reserve);
731 while (tot < st.st_size) {
732 ssize_t rd = read(fd, img + tot, st.st_size - tot);
739 if (!rd && tot < st.st_size) {
759 kwboot_hdr_csum8(const void *hdr)
761 const uint8_t *data = hdr;
765 size = kwbheader_size_for_csum(hdr);
767 for (csum = 0; size-- > 0; data++)
774 kwboot_img_is_secure(void *img)
776 struct opt_hdr_v1 *ohdr;
778 for_each_opt_hdr_v1 (ohdr, img)
779 if (ohdr->headertype == OPT_HDR_V1_SECURE_TYPE)
786 kwboot_img_grow_hdr(void *img, size_t *size, size_t grow)
788 uint32_t hdrsz, datasz, srcaddr;
789 struct main_hdr_v1 *hdr = img;
792 srcaddr = le32_to_cpu(hdr->srcaddr);
794 hdrsz = kwbheader_size(img);
795 data = (uint8_t *)img + srcaddr;
796 datasz = *size - srcaddr;
798 /* only move data if there is not enough space */
799 if (hdrsz + grow > srcaddr) {
800 size_t need = hdrsz + grow - srcaddr;
802 /* move data by enough bytes */
803 memmove(data + need, data, datasz);
805 hdr->srcaddr = cpu_to_le32(srcaddr + need);
809 if (kwbimage_version(img) == 1) {
811 hdr->headersz_msb = hdrsz >> 16;
812 hdr->headersz_lsb = cpu_to_le16(hdrsz & 0xffff);
817 kwboot_img_patch_hdr(void *img, size_t *size)
820 struct main_hdr_v1 *hdr;
823 size_t hdrsz = sizeof(*hdr);
835 image_ver = kwbimage_version(img);
836 if (image_ver != 0 && image_ver != 1) {
837 fprintf(stderr, "Invalid image header version\n");
842 hdrsz = kwbheader_size(hdr);
849 csum = kwboot_hdr_csum8(hdr) - hdr->checksum;
850 if (csum != hdr->checksum) {
855 if (image_ver == 0) {
856 struct main_hdr_v0 *hdr_v0 = img;
858 hdr_v0->nandeccmode = IBR_HDR_ECC_DISABLED;
859 hdr_v0->nandpagesize = 0;
862 srcaddr = le32_to_cpu(hdr->srcaddr);
864 switch (hdr->blockid) {
865 case IBR_HDR_SATA_ID:
870 hdr->srcaddr = cpu_to_le32((srcaddr - 1) * 512);
873 case IBR_HDR_SDIO_ID:
874 hdr->srcaddr = cpu_to_le32(srcaddr * 512);
878 if (srcaddr == 0xFFFFFFFF)
879 hdr->srcaddr = cpu_to_le32(hdrsz);
883 if (hdr->destaddr == cpu_to_le32(0xFFFFFFFF)) {
884 kwboot_printv("Patching destination and execution addresses from SPI/NOR XIP area to DDR area 0x00800000\n");
885 hdr->destaddr = cpu_to_le32(0x00800000);
886 hdr->execaddr = cpu_to_le32(0x00800000);
891 if (hdrsz > le32_to_cpu(hdr->srcaddr) ||
892 *size < le32_to_cpu(hdr->srcaddr) + le32_to_cpu(hdr->blocksize)) {
897 is_secure = kwboot_img_is_secure(img);
899 if (hdr->blockid != IBR_HDR_UART_ID) {
902 "Image has secure header with signature for non-UART booting\n");
907 kwboot_printv("Patching image boot signature to UART\n");
908 hdr->blockid = IBR_HDR_UART_ID;
911 if (hdrsz % KWBOOT_XM_BLKSZ) {
912 size_t offset = (KWBOOT_XM_BLKSZ - hdrsz % KWBOOT_XM_BLKSZ) %
916 fprintf(stderr, "Cannot align image with secure header\n");
921 kwboot_printv("Aligning image header to Xmodem block size\n");
922 kwboot_img_grow_hdr(img, size, offset);
925 hdr->checksum = kwboot_hdr_csum8(hdr) - csum;
927 *size = le32_to_cpu(hdr->srcaddr) + le32_to_cpu(hdr->blocksize);
934 kwboot_usage(FILE *stream, char *progname)
936 fprintf(stream, "kwboot version %s\n", PLAIN_VERSION);
938 "Usage: %s [OPTIONS] [-b <image> | -D <image> ] [-B <baud> ] <TTY>\n",
940 fprintf(stream, "\n");
942 " -b <image>: boot <image> with preamble (Kirkwood, Armada 370/XP)\n");
944 " -D <image>: boot <image> without preamble (Dove)\n");
945 fprintf(stream, " -d: enter debug mode\n");
946 fprintf(stream, " -a: use timings for Armada XP\n");
947 fprintf(stream, " -q <req-delay>: use specific request-delay\n");
948 fprintf(stream, " -s <resp-timeo>: use specific response-timeout\n");
950 " -o <block-timeo>: use specific xmodem block timeout\n");
951 fprintf(stream, "\n");
952 fprintf(stream, " -t: mini terminal\n");
953 fprintf(stream, "\n");
954 fprintf(stream, " -B <baud>: set baud rate\n");
955 fprintf(stream, "\n");
959 main(int argc, char **argv)
961 const char *ttypath, *imgpath;
962 int rv, rc, tty, term;
979 kwboot_verbose = isatty(STDOUT_FILENO);
982 int c = getopt(argc, argv, "hb:ptaB:dD:q:s:o:");
988 bootmsg = kwboot_msg_boot;
998 debugmsg = kwboot_msg_debug;
1002 /* nop, for backward compatibility */
1010 msg_req_delay = KWBOOT_MSG_REQ_DELAY_AXP;
1011 msg_rsp_timeo = KWBOOT_MSG_RSP_TIMEO_AXP;
1015 msg_req_delay = atoi(optarg);
1019 msg_rsp_timeo = atoi(optarg);
1023 blk_rsp_timeo = atoi(optarg);
1027 speed = kwboot_tty_speed(atoi(optarg));
1039 if (!bootmsg && !term && !debugmsg)
1042 if (argc - optind < 1)
1045 ttypath = argv[optind++];
1047 tty = kwboot_open_tty(ttypath, speed);
1054 img = kwboot_read_image(imgpath, &size, KWBOOT_XM_BLKSZ);
1060 rc = kwboot_img_patch_hdr(img, &size);
1062 fprintf(stderr, "%s: Invalid image.\n", imgpath);
1068 rc = kwboot_debugmsg(tty, debugmsg);
1073 } else if (bootmsg) {
1074 rc = kwboot_bootmsg(tty, bootmsg);
1082 rc = kwboot_xmodem(tty, img, size);
1090 rc = kwboot_terminal(tty);
1091 if (rc && !(errno == EINTR)) {
1108 kwboot_usage(rv ? stderr : stdout, basename(argv[0]));