2 * Boot a Marvell SoC, with Xmodem over UART0.
3 * supports Kirkwood, Dove, Armada 370, Armada XP, Armada 375, Armada 38x and
6 * (c) 2012 Daniel Stodden <daniel.stodden@gmail.com>
7 * (c) 2021 Pali Rohár <pali@kernel.org>
8 * (c) 2021 Marek Behún <marek.behun@nic.cz>
10 * References: marvell.com, "88F6180, 88F6190, 88F6192, and 88F6281
11 * Integrated Controller: Functional Specifications" December 2,
12 * 2008. Chapter 24.2 "BootROM Firmware".
33 #include "termios_linux.h"
39 * Marvell BootROM UART Sensing
42 static unsigned char kwboot_msg_boot[] = {
43 0xBB, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77
46 static unsigned char kwboot_msg_debug[] = {
47 0xDD, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77
50 /* Defines known to work on Kirkwood */
51 #define KWBOOT_MSG_REQ_DELAY 10 /* ms */
52 #define KWBOOT_MSG_RSP_TIMEO 50 /* ms */
54 /* Defines known to work on Armada XP */
55 #define KWBOOT_MSG_REQ_DELAY_AXP 1000 /* ms */
56 #define KWBOOT_MSG_RSP_TIMEO_AXP 1000 /* ms */
62 #define SOH 1 /* sender start of block header */
63 #define EOT 4 /* sender end of block transfer */
64 #define ACK 6 /* target block ack */
65 #define NAK 21 /* target block negative ack */
67 #define KWBOOT_XM_BLKSZ 128 /* xmodem block size */
73 uint8_t data[KWBOOT_XM_BLKSZ];
77 #define KWBOOT_BLK_RSP_TIMEO 2000 /* ms */
78 #define KWBOOT_HDR_RSP_TIMEO 10000 /* ms */
80 /* ARM code to change baudrate */
81 static unsigned char kwboot_baud_code[] = {
82 /* ; #define UART_BASE 0xd0012000 */
83 /* ; #define DLL 0x00 */
84 /* ; #define DLH 0x04 */
85 /* ; #define LCR 0x0c */
86 /* ; #define DLAB 0x80 */
87 /* ; #define LSR 0x14 */
88 /* ; #define TEMT 0x40 */
89 /* ; #define DIV_ROUND(a, b) ((a + b/2) / b) */
91 /* ; u32 set_baudrate(u32 old_b, u32 new_b) { */
93 /* ; (!(readl(UART_BASE + LSR) & TEMT)); */
94 /* ; u32 lcr = readl(UART_BASE + LCR); */
95 /* ; writel(UART_BASE + LCR, lcr | DLAB); */
96 /* ; u8 old_dll = readl(UART_BASE + DLL); */
97 /* ; u8 old_dlh = readl(UART_BASE + DLH); */
98 /* ; u16 old_dl = old_dll | (old_dlh << 8); */
99 /* ; u32 clk = old_b * old_dl; */
100 /* ; u16 new_dl = DIV_ROUND(clk, new_b); */
101 /* ; u8 new_dll = new_dl & 0xff; */
102 /* ; u8 new_dlh = (new_dl >> 8) & 0xff; */
103 /* ; writel(UART_BASE + DLL, new_dll); */
104 /* ; writel(UART_BASE + DLH, new_dlh); */
105 /* ; writel(UART_BASE + LCR, lcr & ~DLAB); */
110 /* ; r0 = UART_BASE */
111 0x0d, 0x02, 0xa0, 0xe3, /* mov r0, #0xd0000000 */
112 0x12, 0x0a, 0x80, 0xe3, /* orr r0, r0, #0x12000 */
114 /* ; Wait until Transmitter FIFO is Empty */
115 /* .Lloop_txempty: */
116 /* ; r1 = UART_BASE[LSR] & TEMT */
117 0x14, 0x10, 0x90, 0xe5, /* ldr r1, [r0, #0x14] */
118 0x40, 0x00, 0x11, 0xe3, /* tst r1, #0x40 */
119 0xfc, 0xff, 0xff, 0x0a, /* beq .Lloop_txempty */
121 /* ; Set Divisor Latch Access Bit */
122 /* ; UART_BASE[LCR] |= DLAB */
123 0x0c, 0x10, 0x90, 0xe5, /* ldr r1, [r0, #0x0c] */
124 0x80, 0x10, 0x81, 0xe3, /* orr r1, r1, #0x80 */
125 0x0c, 0x10, 0x80, 0xe5, /* str r1, [r0, #0x0c] */
127 /* ; Read current Divisor Latch */
128 /* ; r1 = UART_BASE[DLH]<<8 | UART_BASE[DLL] */
129 0x00, 0x10, 0x90, 0xe5, /* ldr r1, [r0, #0x00] */
130 0xff, 0x10, 0x01, 0xe2, /* and r1, r1, #0xff */
131 0x01, 0x20, 0xa0, 0xe1, /* mov r2, r1 */
132 0x04, 0x10, 0x90, 0xe5, /* ldr r1, [r0, #0x04] */
133 0xff, 0x10, 0x01, 0xe2, /* and r1, r1, #0xff */
134 0x41, 0x14, 0xa0, 0xe1, /* asr r1, r1, #8 */
135 0x02, 0x10, 0x81, 0xe1, /* orr r1, r1, r2 */
137 /* ; Read old baudrate value */
138 /* ; r2 = old_baudrate */
139 0x74, 0x20, 0x9f, 0xe5, /* ldr r2, old_baudrate */
141 /* ; Calculate base clock */
143 0x92, 0x01, 0x01, 0xe0, /* mul r1, r2, r1 */
145 /* ; Read new baudrate value */
146 /* ; r2 = new_baudrate */
147 0x70, 0x20, 0x9f, 0xe5, /* ldr r2, new_baudrate */
149 /* ; Calculate new Divisor Latch */
150 /* ; r1 = DIV_ROUND(r1, r2) = */
151 /* ; = (r1 + r2/2) / r2 */
152 0xa2, 0x10, 0x81, 0xe0, /* add r1, r1, r2, lsr #1 */
153 0x02, 0x40, 0xa0, 0xe1, /* mov r4, r2 */
154 0xa1, 0x00, 0x54, 0xe1, /* cmp r4, r1, lsr #1 */
156 0x84, 0x40, 0xa0, 0x91, /* movls r4, r4, lsl #1 */
157 0xa1, 0x00, 0x54, 0xe1, /* cmp r4, r1, lsr #1 */
158 0xfc, 0xff, 0xff, 0x9a, /* bls .Lloop_div1 */
159 0x00, 0x30, 0xa0, 0xe3, /* mov r3, #0 */
161 0x04, 0x00, 0x51, 0xe1, /* cmp r1, r4 */
162 0x04, 0x10, 0x41, 0x20, /* subhs r1, r1, r4 */
163 0x03, 0x30, 0xa3, 0xe0, /* adc r3, r3, r3 */
164 0xa4, 0x40, 0xa0, 0xe1, /* mov r4, r4, lsr #1 */
165 0x02, 0x00, 0x54, 0xe1, /* cmp r4, r2 */
166 0xf9, 0xff, 0xff, 0x2a, /* bhs .Lloop_div2 */
167 0x03, 0x10, 0xa0, 0xe1, /* mov r1, r3 */
169 /* ; Set new Divisor Latch Low */
170 /* ; UART_BASE[DLL] = r1 & 0xff */
171 0x01, 0x20, 0xa0, 0xe1, /* mov r2, r1 */
172 0xff, 0x20, 0x02, 0xe2, /* and r2, r2, #0xff */
173 0x00, 0x20, 0x80, 0xe5, /* str r2, [r0, #0x00] */
175 /* ; Set new Divisor Latch High */
176 /* ; UART_BASE[DLH] = r1>>8 & 0xff */
177 0x41, 0x24, 0xa0, 0xe1, /* asr r2, r1, #8 */
178 0xff, 0x20, 0x02, 0xe2, /* and r2, r2, #0xff */
179 0x04, 0x20, 0x80, 0xe5, /* str r2, [r0, #0x04] */
181 /* ; Clear Divisor Latch Access Bit */
182 /* ; UART_BASE[LCR] &= ~DLAB */
183 0x0c, 0x10, 0x90, 0xe5, /* ldr r1, [r0, #0x0c] */
184 0x80, 0x10, 0xc1, 0xe3, /* bic r1, r1, #0x80 */
185 0x0c, 0x10, 0x80, 0xe5, /* str r1, [r0, #0x0c] */
187 /* ; Loop 0x2dc000 (2998272) cycles */
188 /* ; which is about 5ms on 1200 MHz CPU */
189 /* ; r1 = 0x2dc000 */
190 0xb7, 0x19, 0xa0, 0xe3, /* mov r1, #0x2dc000 */
192 0x01, 0x10, 0x41, 0xe2, /* sub r1, r1, #1 */
193 0x00, 0x00, 0x51, 0xe3, /* cmp r1, #0 */
194 0xfc, 0xff, 0xff, 0x1a, /* bne .Lloop_sleep */
196 /* ; Jump to the end of execution */
197 0x01, 0x00, 0x00, 0xea, /* b end */
199 /* ; Placeholder for old baudrate value */
201 0x00, 0x00, 0x00, 0x00, /* .word 0 */
203 /* ; Placeholder for new baudrate value */
205 0x00, 0x00, 0x00, 0x00, /* .word 0 */
210 /* ARM code from binary header executed by BootROM before changing baudrate */
211 static unsigned char kwboot_baud_code_binhdr_pre[] = {
212 /* ; #define UART_BASE 0xd0012000 */
213 /* ; #define THR 0x00 */
214 /* ; #define LSR 0x14 */
215 /* ; #define THRE 0x20 */
217 /* ; void send_preamble(void) { */
218 /* ; const u8 *str = "$baudratechange"; */
222 /* ; ((readl(UART_BASE + LSR) & THRE)); */
224 /* ; writel(UART_BASE + THR, c); */
228 /* ; Preserve registers for BootROM */
229 0xfe, 0x5f, 0x2d, 0xe9, /* push { r1 - r12, lr } */
231 /* ; r0 = UART_BASE */
232 0x0d, 0x02, 0xa0, 0xe3, /* mov r0, #0xd0000000 */
233 0x12, 0x0a, 0x80, 0xe3, /* orr r0, r0, #0x12000 */
235 /* ; r2 = address of preamble string */
236 0x00, 0x20, 0x8f, 0xe2, /* adr r2, .Lstr_preamble */
238 /* ; Skip preamble data section */
239 0x03, 0x00, 0x00, 0xea, /* b .Lloop_preamble */
241 /* ; Preamble string */
242 /* .Lstr_preamble: */
243 0x24, 0x62, 0x61, 0x75, /* .asciz "$baudratechange" */
244 0x64, 0x72, 0x61, 0x74,
245 0x65, 0x63, 0x68, 0x61,
246 0x6e, 0x67, 0x65, 0x00,
248 /* ; Send preamble string over UART */
249 /* .Lloop_preamble: */
251 /* ; Wait until Transmitter Holding is Empty */
253 /* ; r1 = UART_BASE[LSR] & THRE */
254 0x14, 0x10, 0x90, 0xe5, /* ldr r1, [r0, #0x14] */
255 0x20, 0x00, 0x11, 0xe3, /* tst r1, #0x20 */
256 0xfc, 0xff, 0xff, 0x0a, /* beq .Lloop_thre */
258 /* ; Put character into Transmitter FIFO */
260 0x01, 0x10, 0xd2, 0xe4, /* ldrb r1, [r2], #1 */
261 /* ; UART_BASE[THR] = r1 */
262 0x00, 0x10, 0x80, 0xe5, /* str r1, [r0, #0x0] */
264 /* ; Loop until end of preamble string */
265 0x00, 0x00, 0x51, 0xe3, /* cmp r1, #0 */
266 0xf8, 0xff, 0xff, 0x1a, /* bne .Lloop_preamble */
269 /* ARM code for returning from binary header back to BootROM */
270 static unsigned char kwboot_baud_code_binhdr_post[] = {
271 /* ; Return 0 - no error */
272 0x00, 0x00, 0xa0, 0xe3, /* mov r0, #0 */
273 0xfe, 0x9f, 0xbd, 0xe8, /* pop { r1 - r12, pc } */
276 /* ARM code for jumping to the original image exec_addr */
277 static unsigned char kwboot_baud_code_data_jump[] = {
278 0x04, 0xf0, 0x1f, 0xe5, /* ldr pc, exec_addr */
279 /* ; Placeholder for exec_addr */
281 0x00, 0x00, 0x00, 0x00, /* .word 0 */
284 static const char kwb_baud_magic[16] = "$baudratechange";
286 static int kwboot_verbose;
288 static int msg_req_delay = KWBOOT_MSG_REQ_DELAY;
289 static int msg_rsp_timeo = KWBOOT_MSG_RSP_TIMEO;
290 static int blk_rsp_timeo = KWBOOT_BLK_RSP_TIMEO;
293 kwboot_write(int fd, const char *buf, size_t len)
298 ssize_t wr = write(fd, buf + tot, len - tot);
310 kwboot_printv(const char *fmt, ...)
314 if (kwboot_verbose) {
325 const char seq[] = { '-', '\\', '|', '/' };
327 static int state, bs;
329 if (state % div == 0) {
331 fputc(seq[state / div % sizeof(seq)], stdout);
347 __progress(int pct, char c)
349 const int width = 70;
350 static const char *nl = "";
353 if (pos % width == 0)
354 printf("%s%3d %% [", nl, pct);
359 pos = (pos + 1) % width;
362 while (pos && pos++ < width)
374 kwboot_progress(int _pct, char c)
389 kwboot_tty_recv(int fd, void *buf, size_t len, int timeo)
402 tv.tv_usec = timeo * 1000;
403 if (tv.tv_usec > 1000000) {
404 tv.tv_sec += tv.tv_usec / 1000000;
405 tv.tv_usec %= 1000000;
409 nfds = select(fd + 1, &rfds, NULL, NULL, &tv);
417 n = read(fd, buf, len);
421 buf = (char *)buf + n;
431 kwboot_tty_send(int fd, const void *buf, size_t len, int nodrain)
436 if (kwboot_write(fd, buf, len) < 0)
446 kwboot_tty_send_char(int fd, unsigned char c)
448 return kwboot_tty_send(fd, &c, 1, 0);
452 kwboot_tty_baudrate_to_speed(int baudrate)
601 _is_within_tolerance(int value, int reference, int tolerance)
603 return 100 * value >= reference * (100 - tolerance) &&
604 100 * value <= reference * (100 + tolerance);
608 kwboot_tty_change_baudrate(int fd, int baudrate)
614 rc = tcgetattr(fd, &tio);
618 speed = kwboot_tty_baudrate_to_speed(baudrate);
626 tio.c_ospeed = tio.c_ispeed = baudrate;
629 rc = cfsetospeed(&tio, speed);
633 rc = cfsetispeed(&tio, speed);
637 rc = tcsetattr(fd, TCSANOW, &tio);
641 rc = tcgetattr(fd, &tio);
645 if (cfgetospeed(&tio) != speed || cfgetispeed(&tio) != speed)
650 * Check whether set baudrate is within 3% tolerance.
651 * If BOTHER is defined, Linux always fills out c_ospeed / c_ispeed
654 if (!_is_within_tolerance(tio.c_ospeed, baudrate, 3))
657 if (!_is_within_tolerance(tio.c_ispeed, baudrate, 3))
664 fprintf(stderr, "Could not set baudrate to requested value\n");
670 kwboot_open_tty(const char *path, int baudrate)
677 fd = open(path, O_RDWR | O_NOCTTY | O_NDELAY);
681 rc = tcgetattr(fd, &tio);
686 tio.c_cflag |= CREAD | CLOCAL;
687 tio.c_cflag &= ~(CSTOPB | HUPCL | CRTSCTS);
691 rc = tcsetattr(fd, TCSANOW, &tio);
695 flags = fcntl(fd, F_GETFL);
699 rc = fcntl(fd, F_SETFL, flags & ~O_NDELAY);
703 rc = kwboot_tty_change_baudrate(fd, baudrate);
718 kwboot_bootmsg(int tty, void *msg)
725 kwboot_printv("Please reboot the target into UART boot mode...");
727 kwboot_printv("Sending boot message. Please reboot the target...");
730 rc = tcflush(tty, TCIOFLUSH);
734 for (count = 0; count < 128; count++) {
735 rc = kwboot_tty_send(tty, msg, 8, 0);
737 usleep(msg_req_delay * 1000);
742 rc = kwboot_tty_recv(tty, &c, 1, msg_rsp_timeo);
746 } while (rc || c != NAK);
754 kwboot_debugmsg(int tty, void *msg)
758 kwboot_printv("Sending debug message. Please reboot the target...");
763 rc = tcflush(tty, TCIOFLUSH);
767 rc = kwboot_tty_send(tty, msg, 8, 0);
769 usleep(msg_req_delay * 1000);
773 rc = kwboot_tty_recv(tty, buf, 16, msg_rsp_timeo);
785 kwboot_xm_makeblock(struct kwboot_block *block, const void *data,
786 size_t size, int pnum)
792 block->_pnum = ~block->pnum;
794 n = size < KWBOOT_XM_BLKSZ ? size : KWBOOT_XM_BLKSZ;
795 memcpy(&block->data[0], data, n);
796 memset(&block->data[n], 0, KWBOOT_XM_BLKSZ - n);
799 for (i = 0; i < n; i++)
800 block->csum += block->data[i];
810 if (clock_gettime(CLOCK_MONOTONIC, &ts)) {
811 static int err_print;
814 perror("clock_gettime() does not work");
818 /* this will just make the timeout not work */
822 return ts.tv_sec * 1000ULL + (ts.tv_nsec + 500000) / 1000000;
828 return c == ACK || c == NAK;
832 _xm_reply_to_error(int c)
852 kwboot_baud_magic_handle(int fd, char c, int baudrate)
854 static size_t rcv_len;
856 if (rcv_len < sizeof(kwb_baud_magic)) {
857 /* try to recognize whole magic word */
858 if (c == kwb_baud_magic[rcv_len]) {
861 printf("%.*s%c", (int)rcv_len, kwb_baud_magic, c);
867 if (rcv_len == sizeof(kwb_baud_magic)) {
868 /* magic word received */
869 kwboot_printv("\nChanging baudrate to %d Bd\n", baudrate);
871 return kwboot_tty_change_baudrate(fd, baudrate) ? : 1;
878 kwboot_xm_recv_reply(int fd, char *c, int stop_on_non_xm,
879 int ignore_nak_reply,
880 int allow_non_xm, int *non_xm_print,
881 int baudrate, int *baud_changed)
883 int timeout = allow_non_xm ? KWBOOT_HDR_RSP_TIMEO : blk_rsp_timeo;
884 uint64_t recv_until = _now() + timeout;
888 rc = kwboot_tty_recv(fd, c, 1, timeout);
890 if (errno != ETIMEDOUT)
892 else if (allow_non_xm && *non_xm_print)
898 /* If received xmodem reply, end. */
899 if (_is_xm_reply(*c)) {
900 if (*c == NAK && ignore_nak_reply) {
901 timeout = recv_until - _now();
909 * If receiving/printing non-xmodem text output is allowed and
910 * such a byte was received, we want to increase receiving time
912 * - print the byte, if it is not part of baudrate change magic
913 * sequence while baudrate change was requested (-B option)
915 * Otherwise decrease timeout by time elapsed.
918 recv_until = _now() + timeout;
920 if (baudrate && !*baud_changed) {
921 rc = kwboot_baud_magic_handle(fd, *c, baudrate);
928 } else if (!baudrate || !*baud_changed) {
936 timeout = recv_until - _now();
948 kwboot_xm_sendblock(int fd, struct kwboot_block *block, int allow_non_xm,
949 int *done_print, int baudrate)
951 int non_xm_print, baud_changed;
952 int rc, err, retries;
961 rc = kwboot_tty_send(fd, block, sizeof(*block), 1);
965 if (allow_non_xm && !*done_print) {
966 kwboot_progress(100, '.');
967 kwboot_printv("Done\n");
971 rc = kwboot_xm_recv_reply(fd, &c, retries < 3,
973 allow_non_xm, &non_xm_print,
974 baudrate, &baud_changed);
978 if (!allow_non_xm && c != ACK)
979 kwboot_progress(-1, '+');
980 } while (c == NAK && retries++ < 16);
985 if (allow_non_xm && baudrate && !baud_changed) {
986 fprintf(stderr, "Baudrate was not changed\n");
991 return _xm_reply_to_error(c);
1000 kwboot_xm_finish(int fd)
1005 kwboot_printv("Finishing transfer\n");
1009 rc = kwboot_tty_send_char(fd, EOT);
1013 rc = kwboot_xm_recv_reply(fd, &c, retries < 3,
1018 } while (c == NAK && retries++ < 16);
1020 return _xm_reply_to_error(c);
1024 kwboot_xmodem_one(int tty, int *pnum, int header, const uint8_t *data,
1025 size_t size, int baudrate)
1031 kwboot_printv("Sending boot image %s (%zu bytes)...\n",
1032 header ? "header" : "data", size);
1037 while (sent < size) {
1038 struct kwboot_block block;
1042 blksz = kwboot_xm_makeblock(&block, data, left, (*pnum)++);
1045 last_block = (left <= blksz);
1047 rc = kwboot_xm_sendblock(tty, &block, header && last_block,
1048 &done_print, baudrate);
1056 kwboot_progress(sent * 100 / size, '.');
1060 kwboot_printv("Done\n");
1064 kwboot_printv("\n");
1069 kwboot_xmodem(int tty, const void *_img, size_t size, int baudrate)
1071 const uint8_t *img = _img;
1075 hdrsz = kwbheader_size(img);
1078 * If header size is not aligned to xmodem block size (which applies
1079 * for all images in kwbimage v0 format) then we have to ensure that
1080 * the last xmodem block of header contains beginning of the data
1081 * followed by the header. So align header size to xmodem block size.
1083 hdrsz += (KWBOOT_XM_BLKSZ - hdrsz % KWBOOT_XM_BLKSZ) % KWBOOT_XM_BLKSZ;
1085 kwboot_printv("Waiting %d ms and flushing tty\n", blk_rsp_timeo);
1086 usleep(blk_rsp_timeo * 1000);
1087 tcflush(tty, TCIOFLUSH);
1091 rc = kwboot_xmodem_one(tty, &pnum, 1, img, hdrsz, baudrate);
1096 * If we have already sent image data as a part of the last
1097 * xmodem header block then we have nothing more to send.
1102 rc = kwboot_xmodem_one(tty, &pnum, 0, img, size, 0);
1107 rc = kwboot_xm_finish(tty);
1112 kwboot_printv("\nChanging baudrate back to 115200 Bd\n\n");
1113 rc = kwboot_tty_change_baudrate(tty, 115200);
1122 kwboot_term_pipe(int in, int out, const char *quit, int *s)
1125 char _buf[128], *buf = _buf;
1127 nin = read(in, buf, sizeof(_buf));
1134 for (i = 0; i < nin; i++) {
1135 if (*buf == quit[*s]) {
1142 if (kwboot_write(out, quit, *s) < 0)
1149 if (kwboot_write(out, buf, nin) < 0)
1156 kwboot_terminal(int tty)
1159 const char *quit = "\34c";
1160 struct termios otio, tio;
1166 rc = tcgetattr(in, &otio);
1170 rc = tcsetattr(in, TCSANOW, &tio);
1173 perror("tcsetattr");
1177 kwboot_printv("[Type Ctrl-%c + %c to quit]\r\n",
1178 quit[0] | 0100, quit[1]);
1191 nfds = nfds < tty ? tty : nfds;
1195 nfds = nfds < in ? in : nfds;
1198 nfds = select(nfds + 1, &rfds, NULL, NULL, NULL);
1202 if (FD_ISSET(tty, &rfds)) {
1203 rc = kwboot_term_pipe(tty, STDOUT_FILENO, NULL, NULL);
1208 if (in >= 0 && FD_ISSET(in, &rfds)) {
1209 rc = kwboot_term_pipe(in, tty, quit, &s);
1213 } while (quit[s] != 0);
1216 tcsetattr(in, TCSANOW, &otio);
1223 kwboot_read_image(const char *path, size_t *size, size_t reserve)
1233 fd = open(path, O_RDONLY);
1237 rc = fstat(fd, &st);
1241 img = malloc(st.st_size + reserve);
1246 while (tot < st.st_size) {
1247 ssize_t rd = read(fd, img + tot, st.st_size - tot);
1254 if (!rd && tot < st.st_size) {
1274 kwboot_hdr_csum8(const void *hdr)
1276 const uint8_t *data = hdr;
1280 size = kwbheader_size_for_csum(hdr);
1282 for (csum = 0; size-- > 0; data++)
1289 kwboot_img_csum32_ptr(void *img)
1291 struct main_hdr_v1 *hdr = img;
1294 datasz = le32_to_cpu(hdr->blocksize) - sizeof(uint32_t);
1296 return img + le32_to_cpu(hdr->srcaddr) + datasz;
1300 kwboot_img_csum32(const void *img)
1302 const struct main_hdr_v1 *hdr = img;
1303 uint32_t datasz, csum = 0;
1304 const uint32_t *data;
1306 datasz = le32_to_cpu(hdr->blocksize) - sizeof(csum);
1307 if (datasz % sizeof(uint32_t))
1310 data = img + le32_to_cpu(hdr->srcaddr);
1311 while (datasz > 0) {
1312 csum += le32_to_cpu(*data++);
1316 return cpu_to_le32(csum);
1320 kwboot_img_is_secure(void *img)
1322 struct opt_hdr_v1 *ohdr;
1324 for_each_opt_hdr_v1 (ohdr, img)
1325 if (ohdr->headertype == OPT_HDR_V1_SECURE_TYPE)
1332 kwboot_img_grow_data_right(void *img, size_t *size, size_t grow)
1334 struct main_hdr_v1 *hdr = img;
1338 * 32-bit checksum comes after end of image code, so we will be putting
1339 * new code there. So we get this pointer and then increase data size
1340 * (since increasing data size changes kwboot_img_csum32_ptr() return
1343 result = kwboot_img_csum32_ptr(img);
1344 hdr->blocksize = cpu_to_le32(le32_to_cpu(hdr->blocksize) + grow);
1351 kwboot_img_grow_hdr(void *img, size_t *size, size_t grow)
1353 uint32_t hdrsz, datasz, srcaddr;
1354 struct main_hdr_v1 *hdr = img;
1355 struct opt_hdr_v1 *ohdr;
1358 srcaddr = le32_to_cpu(hdr->srcaddr);
1360 /* calculate real used space in kwbimage header */
1361 if (kwbimage_version(img) == 0) {
1362 hdrsz = kwbheader_size(img);
1364 hdrsz = sizeof(*hdr);
1365 for_each_opt_hdr_v1 (ohdr, hdr)
1366 hdrsz += opt_hdr_v1_size(ohdr);
1369 data = (uint8_t *)img + srcaddr;
1370 datasz = *size - srcaddr;
1372 /* only move data if there is not enough space */
1373 if (hdrsz + grow > srcaddr) {
1374 size_t need = hdrsz + grow - srcaddr;
1376 /* move data by enough bytes */
1377 memmove(data + need, data, datasz);
1379 hdr->srcaddr = cpu_to_le32(srcaddr + need);
1383 if (kwbimage_version(img) == 1) {
1385 if (hdrsz > kwbheader_size(img)) {
1386 hdr->headersz_msb = hdrsz >> 16;
1387 hdr->headersz_lsb = cpu_to_le16(hdrsz & 0xffff);
1393 kwboot_add_bin_ohdr_v1(void *img, size_t *size, uint32_t binsz)
1395 struct main_hdr_v1 *hdr = img;
1396 struct opt_hdr_v1 *ohdr;
1403 for_each_opt_hdr_v1 (ohdr, img)
1404 if (opt_hdr_v1_next(ohdr) == NULL)
1407 prev_ext = opt_hdr_v1_ext(ohdr);
1408 ohdr = _opt_hdr_v1_next(ohdr);
1410 ohdr = (void *)(hdr + 1);
1411 prev_ext = &hdr->ext;
1415 * ARM executable code inside the BIN header on some mvebu platforms
1416 * (e.g. A370, AXP) must always be aligned with the 128-bit boundary.
1417 * This requirement can be met by inserting dummy arguments into
1418 * BIN header, if needed.
1420 offset = &ohdr->data[4] - (char *)img;
1421 num_args = ((16 - offset % 16) % 16) / sizeof(uint32_t);
1423 ohdrsz = sizeof(*ohdr) + 4 + 4 * num_args + binsz + 4;
1424 kwboot_img_grow_hdr(hdr, size, ohdrsz);
1428 ohdr->headertype = OPT_HDR_V1_BINARY_TYPE;
1429 ohdr->headersz_msb = ohdrsz >> 16;
1430 ohdr->headersz_lsb = cpu_to_le16(ohdrsz & 0xffff);
1432 memset(&ohdr->data[0], 0, ohdrsz - sizeof(*ohdr));
1433 *(uint32_t *)&ohdr->data[0] = cpu_to_le32(num_args);
1435 return &ohdr->data[4 + 4 * num_args];
1439 _inject_baudrate_change_code(void *img, size_t *size, int for_data,
1440 int old_baud, int new_baud)
1442 struct main_hdr_v1 *hdr = img;
1443 uint32_t orig_datasz;
1448 orig_datasz = le32_to_cpu(hdr->blocksize) - sizeof(uint32_t);
1450 codesz = sizeof(kwboot_baud_code) +
1451 sizeof(kwboot_baud_code_data_jump);
1452 code = kwboot_img_grow_data_right(img, size, codesz);
1454 codesz = sizeof(kwboot_baud_code_binhdr_pre) +
1455 sizeof(kwboot_baud_code) +
1456 sizeof(kwboot_baud_code_binhdr_post);
1457 code = kwboot_add_bin_ohdr_v1(img, size, codesz);
1459 codesz = sizeof(kwboot_baud_code_binhdr_pre);
1460 memcpy(code, kwboot_baud_code_binhdr_pre, codesz);
1464 codesz = sizeof(kwboot_baud_code) - 2 * sizeof(uint32_t);
1465 memcpy(code, kwboot_baud_code, codesz);
1467 *(uint32_t *)code = cpu_to_le32(old_baud);
1468 code += sizeof(uint32_t);
1469 *(uint32_t *)code = cpu_to_le32(new_baud);
1470 code += sizeof(uint32_t);
1473 codesz = sizeof(kwboot_baud_code_data_jump) - sizeof(uint32_t);
1474 memcpy(code, kwboot_baud_code_data_jump, codesz);
1476 *(uint32_t *)code = hdr->execaddr;
1477 code += sizeof(uint32_t);
1478 hdr->execaddr = cpu_to_le32(le32_to_cpu(hdr->destaddr) + orig_datasz);
1480 codesz = sizeof(kwboot_baud_code_binhdr_post);
1481 memcpy(code, kwboot_baud_code_binhdr_post, codesz);
1487 kwboot_img_patch(void *img, size_t *size, int baudrate)
1489 struct main_hdr_v1 *hdr;
1498 if (*size < sizeof(struct main_hdr_v1))
1501 image_ver = kwbimage_version(img);
1502 if (image_ver != 0 && image_ver != 1) {
1503 fprintf(stderr, "Invalid image header version\n");
1507 hdrsz = kwbheader_size(hdr);
1512 csum = kwboot_hdr_csum8(hdr) - hdr->checksum;
1513 if (csum != hdr->checksum)
1516 srcaddr = le32_to_cpu(hdr->srcaddr);
1518 switch (hdr->blockid) {
1519 case IBR_HDR_SATA_ID:
1523 hdr->srcaddr = cpu_to_le32((srcaddr - 1) * 512);
1526 case IBR_HDR_SDIO_ID:
1527 hdr->srcaddr = cpu_to_le32(srcaddr * 512);
1530 case IBR_HDR_PEX_ID:
1531 if (srcaddr == 0xFFFFFFFF)
1532 hdr->srcaddr = cpu_to_le32(hdrsz);
1535 case IBR_HDR_SPI_ID:
1536 if (hdr->destaddr == cpu_to_le32(0xFFFFFFFF)) {
1537 kwboot_printv("Patching destination and execution addresses from SPI/NOR XIP area to DDR area 0x00800000\n");
1538 hdr->destaddr = cpu_to_le32(0x00800000);
1539 hdr->execaddr = cpu_to_le32(0x00800000);
1544 if (hdrsz > le32_to_cpu(hdr->srcaddr) ||
1545 *size < le32_to_cpu(hdr->srcaddr) + le32_to_cpu(hdr->blocksize))
1548 if (kwboot_img_csum32(img) != *kwboot_img_csum32_ptr(img))
1551 is_secure = kwboot_img_is_secure(img);
1553 if (hdr->blockid != IBR_HDR_UART_ID) {
1556 "Image has secure header with signature for non-UART booting\n");
1560 kwboot_printv("Patching image boot signature to UART\n");
1561 hdr->blockid = IBR_HDR_UART_ID;
1565 if (image_ver == 1) {
1567 * Tell BootROM to send BootROM messages to UART port
1568 * number 0 (used also for UART booting) with default
1569 * baudrate (which should be 115200) and do not touch
1570 * UART MPP configuration.
1572 hdr->options &= ~0x1F;
1573 hdr->options |= MAIN_HDR_V1_OPT_BAUD_DEFAULT;
1574 hdr->options |= 0 << 3;
1577 ((struct main_hdr_v0 *)img)->nandeccmode = IBR_HDR_ECC_DISABLED;
1578 hdr->nandpagesize = 0;
1582 if (image_ver == 0) {
1584 "Cannot inject code for changing baudrate into v0 image header\n");
1590 "Cannot inject code for changing baudrate into image with secure header\n");
1595 * First inject code that changes the baudrate from the default
1596 * value of 115200 Bd to requested value. This code is inserted
1597 * as a new opt hdr, so it is executed by BootROM after the
1598 * header part is received.
1600 kwboot_printv("Injecting binary header code for changing baudrate to %d Bd\n",
1602 _inject_baudrate_change_code(img, size, 0, 115200, baudrate);
1605 * Now inject code that changes the baudrate back to 115200 Bd.
1606 * This code is appended after the data part of the image, and
1607 * execaddr is changed so that it is executed before U-Boot
1610 kwboot_printv("Injecting code for changing baudrate back\n");
1611 _inject_baudrate_change_code(img, size, 1, baudrate, 115200);
1613 /* Update the 32-bit data checksum */
1614 *kwboot_img_csum32_ptr(img) = kwboot_img_csum32(img);
1616 /* recompute header size */
1617 hdrsz = kwbheader_size(hdr);
1620 if (hdrsz % KWBOOT_XM_BLKSZ) {
1621 size_t grow = KWBOOT_XM_BLKSZ - hdrsz % KWBOOT_XM_BLKSZ;
1624 fprintf(stderr, "Cannot align image with secure header\n");
1628 kwboot_printv("Aligning image header to Xmodem block size\n");
1629 kwboot_img_grow_hdr(img, size, grow);
1632 hdr->checksum = kwboot_hdr_csum8(hdr) - csum;
1634 *size = le32_to_cpu(hdr->srcaddr) + le32_to_cpu(hdr->blocksize);
1642 kwboot_usage(FILE *stream, char *progname)
1645 "Usage: %s [OPTIONS] [-b <image> | -D <image> ] [-B <baud> ] <TTY>\n",
1647 fprintf(stream, "\n");
1649 " -b <image>: boot <image> with preamble (Kirkwood, Armada 370/XP)\n");
1651 " -D <image>: boot <image> without preamble (Dove)\n");
1652 fprintf(stream, " -d: enter debug mode\n");
1653 fprintf(stream, " -a: use timings for Armada XP\n");
1654 fprintf(stream, " -q <req-delay>: use specific request-delay\n");
1655 fprintf(stream, " -s <resp-timeo>: use specific response-timeout\n");
1657 " -o <block-timeo>: use specific xmodem block timeout\n");
1658 fprintf(stream, "\n");
1659 fprintf(stream, " -t: mini terminal\n");
1660 fprintf(stream, "\n");
1661 fprintf(stream, " -B <baud>: set baud rate\n");
1662 fprintf(stream, "\n");
1666 main(int argc, char **argv)
1668 const char *ttypath, *imgpath;
1669 int rv, rc, tty, term;
1674 size_t after_img_rsv;
1685 after_img_rsv = KWBOOT_XM_BLKSZ;
1688 printf("kwboot version %s\n", PLAIN_VERSION);
1690 kwboot_verbose = isatty(STDOUT_FILENO);
1693 int c = getopt(argc, argv, "hb:ptaB:dD:q:s:o:");
1699 bootmsg = kwboot_msg_boot;
1709 debugmsg = kwboot_msg_debug;
1713 /* nop, for backward compatibility */
1721 msg_req_delay = KWBOOT_MSG_REQ_DELAY_AXP;
1722 msg_rsp_timeo = KWBOOT_MSG_RSP_TIMEO_AXP;
1726 msg_req_delay = atoi(optarg);
1730 msg_rsp_timeo = atoi(optarg);
1734 blk_rsp_timeo = atoi(optarg);
1738 baudrate = atoi(optarg);
1748 if (!bootmsg && !term && !debugmsg)
1751 if (argc - optind < 1)
1754 ttypath = argv[optind++];
1756 tty = kwboot_open_tty(ttypath, imgpath ? 115200 : baudrate);
1762 if (baudrate == 115200)
1763 /* do not change baudrate during Xmodem to the same value */
1766 /* ensure we have enough space for baudrate change code */
1767 after_img_rsv += sizeof(struct opt_hdr_v1) + 8 + 16 +
1768 sizeof(kwboot_baud_code_binhdr_pre) +
1769 sizeof(kwboot_baud_code) +
1770 sizeof(kwboot_baud_code_binhdr_post) +
1772 sizeof(kwboot_baud_code) +
1773 sizeof(kwboot_baud_code_data_jump) +
1777 img = kwboot_read_image(imgpath, &size, after_img_rsv);
1783 rc = kwboot_img_patch(img, &size, baudrate);
1785 fprintf(stderr, "%s: Invalid image.\n", imgpath);
1791 rc = kwboot_debugmsg(tty, debugmsg);
1796 } else if (bootmsg) {
1797 rc = kwboot_bootmsg(tty, bootmsg);
1805 rc = kwboot_xmodem(tty, img, size, baudrate);
1813 rc = kwboot_terminal(tty);
1814 if (rc && !(errno == EINTR)) {
1831 kwboot_usage(rv ? stderr : stdout, basename(argv[0]));