common/cmd_bootce.c

   1 /*
   2  * Copyright (C) 2012 Lothar Waßmann <LW@KARO-electronics.de>
   3  * based on: code from RedBoot (C) Uwe Steinkohl <US@KARO-electronics.de>
   4  *
   5  * See file CREDITS for list of people who contributed to this
   6  * project.
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU General Public License as
  10  * published by the Free Software Foundation; either version 2 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
  21  * MA 02111-1307 USA
  22  */
  23
  24 #include <common.h>
  25 #include <command.h>
  26 #include <net.h>
  27 #include <wince.h>
  28 #include <nand.h>
  29 #include <malloc.h>
  30 #include <asm/errno.h>
  31 #include <jffs2/load_kernel.h>
  32
  33 DECLARE_GLOBAL_DATA_PTR;
  34
  35 #define WINCE_VRAM_BASE         0x80000000
  36 #define CE_FIX_ADDRESS(a)       ((void *)((a) - WINCE_VRAM_BASE + CONFIG_SYS_SDRAM_BASE))
  37
  38 #ifndef INT_MAX
  39 #define INT_MAX                 ((int)(~0U >> 1))
  40 #endif
  41
  42 /* Bin image parse states */
  43 #define CE_PS_RTI_ADDR          0
  44 #define CE_PS_RTI_LEN           1
  45 #define CE_PS_E_ADDR            2
  46 #define CE_PS_E_LEN             3
  47 #define CE_PS_E_CHKSUM          4
  48 #define CE_PS_E_DATA            5
  49
  50 #define CE_MIN(a, b)            (((a) < (b)) ? (a) : (b))
  51 #define CE_MAX(a, b)            (((a) > (b)) ? (a) : (b))
  52
  53 #define _STRMAC(s)              #s
  54 #define STRMAC(s)               _STRMAC(s)
  55
  56 static ce_bin __attribute__ ((aligned (32))) g_bin;
  57 static ce_net __attribute__ ((aligned (32))) g_net;
  58 static IPaddr_t server_ip;
  59
  60 static void ce_init_bin(ce_bin *bin, unsigned char *dataBuffer)
  61 {
  62         memset(bin, 0, sizeof(*bin));
  63
  64         bin->data = dataBuffer;
  65         bin->parseState = CE_PS_RTI_ADDR;
  66         bin->parsePtr = (unsigned char *)bin;
  67 }
  68
  69 static int ce_is_bin_image(void *image, int imglen)
  70 {
  71         if (imglen < CE_BIN_SIGN_LEN) {
  72                 return 0;
  73         }
  74
  75         return memcmp(image, CE_BIN_SIGN, CE_BIN_SIGN_LEN) == 0;
  76 }
  77
  78 static const struct ce_magic {
  79         char magic[8];
  80         size_t size;
  81         ce_std_driver_globals drv_glb;
  82 } ce_magic_template = {
  83         .magic = "KARO_CE6",
  84         .size = sizeof(ce_std_driver_globals),
  85         .drv_glb = {
  86                 .header = {
  87                         .signature = STD_DRV_GLB_SIGNATURE,
  88                         .oalVersion = 1,
  89                         .bspVersion = 2,
  90                 },
  91         },
  92 };
  93
  94 #ifdef DEBUG
  95 static void __attribute__((unused)) ce_dump_block(void *ptr, int length)
  96 {
  97         char *p = ptr;
  98         int i;
  99         int j;
 100
 101         for (i = 0; i < length; i++) {
 102                 if (!(i % 16)) {
 103                         printf("\n%p: ", ptr + i);
 104                 }
 105
 106                 printf("%02x ", p[i]);
 107                 if (!((i + 1) % 16)){
 108                         printf("      ");
 109                         for (j = i - 15; j <= i; j++){
 110                                 if((p[j] > 0x1f) && (p[j] < 0x7f)) {
 111                                         printf("%c", p[j]);
 112                                 } else {
 113                                         printf(".");
 114                                 }
 115                         }
 116                 }
 117         }
 118         printf("\n");
 119 }
 120 #else
 121 static inline void ce_dump_block(void *ptr, int length)
 122 {
 123 }
 124 #endif
 125
 126 static void ce_setup_std_drv_globals(ce_std_driver_globals *std_drv_glb)
 127 {
 128         char *mtdparts = getenv("mtdparts");
 129         size_t max_len = ALIGN((unsigned long)std_drv_glb, SZ_4K) -
 130                 (unsigned long)&std_drv_glb->mtdparts;
 131
 132         if (eth_get_dev()) {
 133                 memcpy(&std_drv_glb->kitl.mac, eth_get_dev()->enetaddr,
 134                         sizeof(std_drv_glb->kitl.mac));
 135         }
 136         snprintf(std_drv_glb->deviceId, sizeof(std_drv_glb->deviceId),
 137                 "Triton%02X", eth_get_dev()->enetaddr[5]);
 138
 139         NetCopyIP(&std_drv_glb->kitl.ipAddress, &NetOurIP);
 140         std_drv_glb->kitl.ipMask = getenv_IPaddr("netmask");
 141         std_drv_glb->kitl.ipRoute = getenv_IPaddr("gatewayip");
 142
 143         if (mtdparts) {
 144                 strncpy(std_drv_glb->mtdparts, mtdparts, max_len);
 145                 std_drv_glb->mtdparts[max_len - 1] = '\0';
 146         } else {
 147                 printf("Failed to get mtdparts environment variable\n");
 148         }
 149 }
 150
 151 static void ce_prepare_run_bin(ce_bin *bin)
 152 {
 153         ce_driver_globals *drv_glb;
 154         struct ce_magic *ce_magic = (void *)CONFIG_SYS_SDRAM_BASE + 0x160;
 155         ce_std_driver_globals *std_drv_glb = &ce_magic->drv_glb;
 156
 157         /* Clear os RAM area (if needed) */
 158         if (bin->edbgConfig.flags & EDBG_FL_CLEANBOOT) {
 159                 debug("cleaning memory from %p to %p\n",
 160                         bin->eRamStart, bin->eRamStart + bin->eRamLen);
 161
 162                 printf("Preparing clean boot ... ");
 163                 memset(bin->eRamStart, 0, bin->eRamLen);
 164                 printf("ok\n");
 165         }
 166
 167         /* Prepare driver globals (if needed) */
 168         if (bin->eDrvGlb) {
 169                 debug("Copying CE MAGIC from %p to %p..%p\n",
 170                         &ce_magic_template, ce_magic,
 171                         (void *)ce_magic + sizeof(*ce_magic) - 1);
 172                 memcpy(ce_magic, &ce_magic_template, sizeof(*ce_magic));
 173
 174                 ce_setup_std_drv_globals(std_drv_glb);
 175                 ce_magic->size = sizeof(*std_drv_glb) +
 176                         strlen(std_drv_glb->mtdparts) + 1;
 177                 ce_dump_block(ce_magic, offsetof(struct ce_magic, drv_glb) +
 178                         ce_magic->size);
 179
 180                 drv_glb = bin->eDrvGlb;
 181                 memset(drv_glb, 0, sizeof(*drv_glb));
 182
 183                 drv_glb->signature = DRV_GLB_SIGNATURE;
 184
 185                 /* Local ethernet MAC address */
 186                 memcpy(drv_glb->macAddr, std_drv_glb->kitl.mac,
 187                         sizeof(drv_glb->macAddr));
 188                 debug("got MAC address %02x:%02x:%02x:%02x:%02x:%02x from environment\n",
 189                         drv_glb->macAddr[0], drv_glb->macAddr[1],
 190                         drv_glb->macAddr[2], drv_glb->macAddr[3],
 191                         drv_glb->macAddr[4], drv_glb->macAddr[5]);
 192
 193                 /* Local IP address */
 194                 drv_glb->ipAddr = getenv_IPaddr("ipaddr");
 195
 196                 /* Subnet mask */
 197                 drv_glb->ipMask = getenv_IPaddr("netmask");
 198
 199                 /* Gateway config */
 200                 drv_glb->ipGate = getenv_IPaddr("gatewayip");
 201 #ifdef DEBUG
 202                 debug("got IP address %pI4 from environment\n", &drv_glb->ipAddr);
 203                 debug("got IP mask %pI4 from environment\n", &drv_glb->ipMask);
 204                 debug("got gateway address %pI4 from environment\n", &drv_glb->ipGate);
 205 #endif
 206                 /* EDBG services config */
 207                 memcpy(&drv_glb->edbgConfig, &bin->edbgConfig,
 208                         sizeof(bin->edbgConfig));
 209         }
 210
 211         /*
 212          * Make sure, all the above makes it into SDRAM because
 213          * WinCE switches the cache & MMU off, obviously without
 214          * flushing it first!
 215          */
 216         flush_dcache_all();
 217 }
 218
 219 static int ce_lookup_ep_bin(ce_bin *bin)
 220 {
 221         ce_rom_hdr *header;
 222         ce_toc_entry *tentry;
 223         e32_rom *e32;
 224         unsigned int i;
 225         uint32_t *sig = (uint32_t *)(bin->rtiPhysAddr + ROM_SIGNATURE_OFFSET);
 226
 227         debug("Looking for TOC signature at %p\n", sig);
 228
 229         /* Check image Table Of Contents (TOC) signature */
 230         if (*sig != ROM_SIGNATURE) {
 231                 printf("Error: Did not find image TOC signature!\n");
 232                 printf("Expected %08x at address %p; found %08x instead\n",
 233                         ROM_SIGNATURE, sig, *sig);
 234                 return 0;
 235         }
 236
 237         /* Lookup entry point */
 238         header = CE_FIX_ADDRESS(*(unsigned int *)(bin->rtiPhysAddr +
 239                                                 ROM_SIGNATURE_OFFSET +
 240                                                 sizeof(unsigned int)));
 241         tentry = (ce_toc_entry *)(header + 1);
 242
 243         for (i = 0; i < header->nummods; i++) {
 244                 // Look for 'nk.exe' module
 245                 if (strcmp(CE_FIX_ADDRESS(tentry[i].fileName), "nk.exe") == 0) {
 246                         // Save entry point and RAM addresses
 247
 248                         e32 = CE_FIX_ADDRESS(tentry[i].e32Offset);
 249
 250                         bin->eEntryPoint = CE_FIX_ADDRESS(tentry[i].loadOffset) +
 251                                 e32->e32_entryrva;
 252                         bin->eRamStart = CE_FIX_ADDRESS(header->ramStart);
 253                         bin->eRamLen = header->ramEnd - header->ramStart;
 254                         // Save driver_globals address
 255                         // Must follow RAM section in CE config.bib file
 256                         //
 257                         // eg.
 258                         //
 259                         // RAM          80900000        03200000        RAM
 260                         // DRV_GLB      83B00000        00001000        RESERVED
 261                         //
 262                         bin->eDrvGlb = CE_FIX_ADDRESS(header->ramEnd);
 263                         return 1;
 264                 }
 265         }
 266
 267         // Error: Did not find 'nk.exe' module
 268         return 0;
 269 }
 270
 271 static int ce_parse_bin(ce_bin *bin)
 272 {
 273         unsigned char *pbData = bin->data;
 274         int len = bin->dataLen;
 275         int copyLen;
 276
 277         debug("starting ce image parsing:\n\tbin->binLen: 0x%08X\n", bin->binLen);
 278
 279         if (len) {
 280                 if (bin->binLen == 0) {
 281                         // Check for the .BIN signature first
 282                         if (!ce_is_bin_image(pbData, len)) {
 283                                 printf("Error: Invalid or corrupted .BIN image!\n");
 284                                 return CE_PR_ERROR;
 285                         }
 286
 287                         printf("Loading Windows CE .BIN image ...\n");
 288                         // Skip signature
 289                         len -= CE_BIN_SIGN_LEN;
 290                         pbData += CE_BIN_SIGN_LEN;
 291                 }
 292
 293                 while (len) {
 294                         switch (bin->parseState) {
 295                         case CE_PS_RTI_ADDR:
 296                         case CE_PS_RTI_LEN:
 297                         case CE_PS_E_ADDR:
 298                         case CE_PS_E_LEN:
 299                         case CE_PS_E_CHKSUM:
 300                                 copyLen = CE_MIN(sizeof(unsigned int) - bin->parseLen, len);
 301                                 memcpy(&bin->parsePtr[bin->parseLen], pbData, copyLen);
 302
 303                                 bin->parseLen += copyLen;
 304                                 len -= copyLen;
 305                                 pbData += copyLen;
 306
 307                                 if (bin->parseLen == sizeof(unsigned int)) {
 308                                         if (bin->parseState == CE_PS_RTI_ADDR)
 309                                                 bin->rtiPhysAddr = CE_FIX_ADDRESS(bin->rtiPhysAddr);
 310                                         else if (bin->parseState == CE_PS_E_ADDR &&
 311                                                 bin->ePhysAddr)
 312                                                 bin->ePhysAddr = CE_FIX_ADDRESS(bin->ePhysAddr);
 313
 314                                         bin->parseState++;
 315                                         bin->parseLen = 0;
 316                                         bin->parsePtr += sizeof(unsigned int);
 317
 318                                         if (bin->parseState == CE_PS_E_DATA) {
 319                                                 if (bin->ePhysAddr) {
 320                                                         bin->parsePtr = bin->ePhysAddr;
 321                                                         bin->parseChkSum = 0;
 322                                                 } else {
 323                                                         /* EOF */
 324                                                         len = 0;
 325                                                         bin->endOfBin = 1;
 326                                                 }
 327                                         }
 328                                 }
 329                                 break;
 330
 331                         case CE_PS_E_DATA:
 332                                 debug("ePhysAddr=%p physlen=%08x parselen=%08x\n",
 333                                         bin->ePhysAddr, bin->ePhysLen, bin->parseLen);
 334                                 if (bin->ePhysAddr) {
 335                                         copyLen = CE_MIN(bin->ePhysLen - bin->parseLen, len);
 336                                         bin->parseLen += copyLen;
 337                                         len -= copyLen;
 338
 339                                         while (copyLen--) {
 340                                                 bin->parseChkSum += *pbData;
 341                                                 *bin->parsePtr++ = *pbData++;
 342                                         }
 343
 344                                         if (bin->parseLen == bin->ePhysLen) {
 345                                                 printf("Section [%02d]: address %p, size 0x%08X, checksum %s\n",
 346                                                         bin->section,
 347                                                         bin->ePhysAddr,
 348                                                         bin->ePhysLen,
 349                                                         (bin->eChkSum == bin->parseChkSum) ? "ok" : "fail");
 350
 351                                                 if (bin->eChkSum != bin->parseChkSum) {
 352                                                         printf("Error: Checksum error, corrupted .BIN file!\n");
 353                                                         printf("checksum calculated: 0x%08x from file: 0x%08x\n",
 354                                                                 bin->parseChkSum, bin->eChkSum);
 355                                                         bin->binLen = 0;
 356                                                         return CE_PR_ERROR;
 357                                                 }
 358
 359                                                 bin->section++;
 360                                                 bin->parseState = CE_PS_E_ADDR;
 361                                                 bin->parseLen = 0;
 362                                                 bin->parsePtr = (unsigned char *)&bin->ePhysAddr;
 363                                         }
 364                                 } else {
 365                                         bin->parseLen = 0;
 366                                         bin->endOfBin = 1;
 367                                         len = 0;
 368                                 }
 369                                 break;
 370                         }
 371                 }
 372         }
 373
 374         if (bin->endOfBin) {
 375                 if (!ce_lookup_ep_bin(bin)) {
 376                         printf("Error: entry point not found!\n");
 377                         bin->binLen = 0;
 378                         return CE_PR_ERROR;
 379                 }
 380
 381                 printf("Entry point: %p, address range: %p-%p\n",
 382                         bin->eEntryPoint,
 383                         bin->rtiPhysAddr,
 384                         bin->rtiPhysAddr + bin->rtiPhysLen);
 385
 386                 return CE_PR_EOF;
 387         }
 388
 389         /* Need more data */
 390         bin->binLen += bin->dataLen;
 391         return CE_PR_MORE;
 392 }
 393
 394 static int ce_bin_load(void *image, int imglen)
 395 {
 396         ce_init_bin(&g_bin, image);
 397         g_bin.dataLen = imglen;
 398         if (ce_parse_bin(&g_bin) == CE_PR_EOF) {
 399                 ce_prepare_run_bin(&g_bin);
 400                 return 1;
 401         }
 402
 403         return 0;
 404 }
 405
 406 static void ce_run_bin(void (*entry)(void))
 407 {
 408         printf("Launching Windows CE ...\n");
 409 #ifdef TEST_LAUNCH
 410 return;
 411 #endif
 412         entry();
 413 }
 414
 415 static int do_bootce(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 416 {
 417         void *addr;
 418         size_t image_size;
 419
 420         if (argc > 1) {
 421                 addr = (void *)simple_strtoul(argv[1], NULL, 16);
 422                 image_size = INT_MAX;           /* actually we do not know the image size */
 423         } else if (getenv("fileaddr") != NULL) {
 424                 addr = (void *)getenv_ulong("fileaddr", 16, 0);
 425                 image_size = getenv_ulong("filesize", 16, INT_MAX);
 426         } else {
 427                 return CMD_RET_USAGE;
 428         }
 429
 430         printf ("## Booting Windows CE Image from address %p ...\n", addr);
 431
 432         /* check if there is a valid windows CE image */
 433         if (ce_is_bin_image(addr, image_size)) {
 434                 if (!ce_bin_load(addr, image_size)) {
 435                         /* Ops! Corrupted .BIN image! */
 436                         /* Handle error here ...      */
 437                         printf("corrupted .BIN image !!!\n");
 438                         return CMD_RET_FAILURE;
 439                 }
 440                 if (getenv_yesno("autostart") != 1) {
 441                         /*
 442                          * just use bootce to load the image to SDRAM;
 443                          * Do not start it automatically.
 444                          */
 445                         setenv_addr("fileaddr", g_bin.eEntryPoint);
 446                         return CMD_RET_SUCCESS;
 447                 }
 448                 ce_run_bin(g_bin.eEntryPoint);          /* start the image */
 449         } else {
 450                 printf("Image does not seem to be a valid Windows CE image!\n");
 451                 return CMD_RET_FAILURE;
 452         }
 453         return CMD_RET_FAILURE; /* never reached - just to keep compiler happy */
 454 }
 455 U_BOOT_CMD(
 456         bootce, 2, 0, do_bootce,
 457         "Boot a Windows CE image from RAM\n",
 458         "[addr]\n"
 459         "\taddr\t\tboot image from address addr (default ${fileaddr})\n"
 460 );
 461
 462 static int ce_nand_load(ce_bin *bin, size_t offset, void *buf, size_t max_len)
 463 {
 464         int ret;
 465         size_t len = max_len;
 466
 467         ret = nand_read_skip_bad(&nand_info[0], offset, &len, buf);
 468         if (ret < 0) {
 469                 printf("NBOOTCE - aborted\n");
 470                 return ret;
 471         }
 472         bin->dataLen = len;
 473         return len;
 474 }
 475
 476 #define CE_NAND_BUF_SIZE        2048
 477
 478 static int do_nbootce(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 479 {
 480         int ret;
 481         struct mtd_device *dev;
 482         struct part_info *part_info;
 483         u8 part_num;
 484         size_t offset;
 485         char *end;
 486         void *buffer;
 487         size_t len = CE_NAND_BUF_SIZE;
 488
 489         if (argc < 2 || argc > 3)
 490                 return CMD_RET_USAGE;
 491
 492         ret = mtdparts_init();
 493         if (ret)
 494                 return CMD_RET_FAILURE;
 495
 496         offset = simple_strtoul(argv[1], &end, 16);
 497         if (*end != '\0') {
 498                 ret = find_dev_and_part(argv[1], &dev, &part_num,
 499                                         &part_info);
 500                 if (ret != 0) {
 501                         printf("Partition '%s' not found\n", argv[1]);
 502                         return CMD_RET_FAILURE;
 503                 }
 504                 offset = part_info->offset;
 505                 printf ("## Booting Windows CE Image from NAND partition %s at offset %08x\n",
 506                         argv[1], offset);
 507         } else {
 508                 printf ("## Booting Windows CE Image from NAND offset %08x\n",
 509                         offset);
 510         }
 511
 512         buffer = malloc(CE_NAND_BUF_SIZE);
 513         if (buffer == NULL) {
 514                 printf("Failed to allocate %u byte buffer\n", CE_NAND_BUF_SIZE);
 515                 return CMD_RET_FAILURE;
 516         }
 517
 518         ce_init_bin(&g_bin, buffer);
 519
 520         ret = ce_nand_load(&g_bin, offset, buffer,
 521                         CE_NAND_BUF_SIZE);
 522         if (ret < 0) {
 523                 printf("Failed to read NAND: %d\n", ret);
 524                 goto err;
 525         }
 526         len = ret;
 527         /* check if there is a valid windows CE image header */
 528         if (ce_is_bin_image(buffer, len)) {
 529                 while (ce_parse_bin(&g_bin) == CE_PR_MORE) {
 530                         if (ctrlc()) {
 531                                 printf("NBOOTCE - canceled by user\n");
 532                                 goto err;
 533                         }
 534                         offset += len;
 535                         ret = ce_nand_load(&g_bin, offset, buffer,
 536                                         CE_NAND_BUF_SIZE);
 537                         if (ret < 0)
 538                                 goto err;
 539                         len = ret;
 540                 }
 541                 free(buffer);
 542                 if (getenv_yesno("autostart") != 1) {
 543                         /*
 544                          * just use bootce to load the image to SDRAM;
 545                          * Do not start it automatically.
 546                          */
 547                         setenv_addr("fileaddr", g_bin.eEntryPoint);
 548                         return CMD_RET_SUCCESS;
 549                 }
 550                 ce_run_bin(g_bin.eEntryPoint);          /* start the image */
 551         } else {
 552                 printf("Image does not seem to be a valid Windows CE image!\n");
 553         }
 554 err:
 555         free(buffer);
 556         return CMD_RET_FAILURE;
 557 }
 558 U_BOOT_CMD(
 559         nbootce, 2, 0, do_nbootce,
 560         "Boot a Windows CE image from NAND\n",
 561         "off|partitition\n"
 562         "\toff\t\t- flash offset (hex)\n"
 563         "\tpartition\t- partition name\n"
 564 );
 565
 566 static int ce_send_write_ack(ce_net *net)
 567 {
 568         int ret;
 569         unsigned short wdata[2];
 570         int retries = 0;
 571
 572         wdata[0] = htons(EDBG_CMD_WRITE_ACK);
 573         wdata[1] = htons(net->blockNum);
 574         net->dataLen = sizeof(wdata);
 575         memcpy(net->data, wdata, net->dataLen);
 576
 577         do {
 578                 ret = bootme_send_frame(net->data, net->dataLen);
 579                 if (ret) {
 580                         printf("Failed to send write ack %d; retries=%d\n",
 581                                 ret, retries);
 582                 }
 583         } while (ret != 0 && retries-- > 0);
 584         return ret;
 585 }
 586
 587 static enum bootme_state ce_process_download(ce_net *net, ce_bin *bin)
 588 {
 589         int ret = net->state;
 590
 591         if (net->dataLen >= 4) {
 592                 unsigned short command;
 593                 unsigned short blknum;
 594
 595                 memcpy(&command, net->data, sizeof(command));
 596                 command = ntohs(command);
 597                 debug("command found: 0x%04X\n", command);
 598
 599                 if (net->state == BOOTME_DOWNLOAD) {
 600                         unsigned short nxt = net->blockNum + 1;
 601
 602                         memcpy(&blknum, &net->data[2], sizeof(blknum));
 603                         blknum = ntohs(blknum);
 604                         if (blknum == nxt) {
 605                                 net->blockNum = blknum;
 606                         } else {
 607                                 int rc = ce_send_write_ack(net);
 608
 609                                 printf("Dropping out of sequence packet with ID %d (expected %d)\n",
 610                                         blknum, nxt);
 611                                 if (rc != 0)
 612                                         return rc;
 613
 614                                 return ret;
 615                         }
 616                 }
 617
 618                 switch (command) {
 619                 case EDBG_CMD_WRITE_REQ:
 620                         if (net->state == BOOTME_INIT) {
 621                                 // Check file name for WRITE request
 622                                 // CE EShell uses "boot.bin" file name
 623                                 if (strncmp((char *)&net->data[2],
 624                                                 "boot.bin", 8) == 0) {
 625                                         // Some diag output
 626                                         if (net->verbose) {
 627                                                 printf("Locked Down download link, IP: %pI4\n",
 628                                                         &NetServerIP);
 629                                                 printf("Sending BOOTME request [%d] to %pI4\n",
 630                                                         net->seqNum, &NetServerIP);
 631                                         }
 632
 633                                         // Lock down EShell download link
 634                                         ret = BOOTME_DOWNLOAD;
 635                                 } else {
 636                                         // Unknown link
 637                                         printf("Unknown link\n");
 638                                 }
 639
 640                                 if (ret == BOOTME_DOWNLOAD) {
 641                                         int rc = ce_send_write_ack(net);
 642                                         if (rc != 0)
 643                                                 return rc;
 644                                 }
 645                         }
 646                         break;
 647
 648                 case EDBG_CMD_WRITE:
 649                         /* Fixup data len */
 650                         bin->data = &net->data[4];
 651                         bin->dataLen = net->dataLen - 4;
 652                         ret = ce_parse_bin(bin);
 653                         if (ret != CE_PR_ERROR) {
 654                                 int rc = ce_send_write_ack(net);
 655                                 if (rc)
 656                                         return rc;
 657                                 if (ret == CE_PR_EOF)
 658                                         ret = BOOTME_DONE;
 659                         } else {
 660                                 ret = BOOTME_ERROR;
 661                         }
 662                         break;
 663
 664                 case EDBG_CMD_READ_REQ:
 665                         printf("Ignoring EDBG_CMD_READ_REQ\n");
 666                         /* Read requests are not supported
 667                          * Do nothing ...
 668                          */
 669                         break;
 670
 671                 case EDBG_CMD_ERROR:
 672                         printf("Error: unknown error on the host side\n");
 673
 674                         bin->binLen = 0;
 675                         ret = BOOTME_ERROR;
 676                         break;
 677
 678                 default:
 679                         printf("unknown command 0x%04X\n", command);
 680                         net->state = BOOTME_ERROR;
 681                 }
 682         }
 683         return ret;
 684 }
 685
 686 static enum bootme_state ce_process_edbg(ce_net *net, ce_bin *bin)
 687 {
 688         enum bootme_state ret = net->state;
 689         eth_dbg_hdr header;
 690
 691         if (net->dataLen < sizeof(header)) {
 692                 /* Bad packet */
 693                 printf("Invalid packet size %u\n", net->dataLen);
 694                 net->dataLen = 0;
 695                 return ret;
 696         }
 697         memcpy(&header, net->data, sizeof(header));
 698         if (header.id != EDBG_ID) {
 699                 /* Bad packet */
 700                 printf("Bad EDBG ID %08x\n", header.id);
 701                 net->dataLen = 0;
 702                 return ret;
 703         }
 704
 705         if (header.service != EDBG_SVC_ADMIN) {
 706                 /* Unknown service */
 707                 printf("Bad EDBG service %02x\n", header.service);
 708                 net->dataLen = 0;
 709                 return ret;
 710         }
 711
 712         if (net->state == BOOTME_INIT) {
 713                 /* Some diag output */
 714                 if (net->verbose) {
 715                         printf("Locked Down EDBG service link, IP: %pI4\n",
 716                                 &NetServerIP);
 717                 }
 718
 719                 /* Lock down EDBG link */
 720                 net->state = BOOTME_DEBUG;
 721         }
 722
 723 debug("%s@%d\n", __func__, __LINE__);
 724         switch (header.cmd) {
 725         case EDBG_CMD_JUMPIMG:
 726 debug("%s@%d\n", __func__, __LINE__);
 727                 net->gotJumpingRequest = 1;
 728
 729                 if (net->verbose) {
 730                         printf("Received JUMPING command\n");
 731                 }
 732                 /* Just pass through and copy CONFIG structure */
 733         case EDBG_CMD_OS_CONFIG:
 734 debug("%s@%d\n", __func__, __LINE__);
 735                 /* Copy config structure */
 736                 memcpy(&bin->edbgConfig, header.data,
 737                         sizeof(edbg_os_config_data));
 738                 if (net->verbose) {
 739                         printf("Received CONFIG command\n");
 740                         if (bin->edbgConfig.flags & EDBG_FL_DBGMSG) {
 741                                 printf("--> Enabling DBGMSG service, IP: %d.%d.%d.%d, port: %d\n",
 742                                         (bin->edbgConfig.dbgMsgIPAddr >> 0) & 0xFF,
 743                                         (bin->edbgConfig.dbgMsgIPAddr >> 8) & 0xFF,
 744                                         (bin->edbgConfig.dbgMsgIPAddr >> 16) & 0xFF,
 745                                         (bin->edbgConfig.dbgMsgIPAddr >> 24) & 0xFF,
 746                                         ntohs(bin->edbgConfig.dbgMsgPort));
 747                         }
 748
 749                         if (bin->edbgConfig.flags & EDBG_FL_PPSH) {
 750                                 printf("--> Enabling PPSH service, IP: %d.%d.%d.%d, port: %d\n",
 751                                         (bin->edbgConfig.ppshIPAddr >> 0) & 0xFF,
 752                                         (bin->edbgConfig.ppshIPAddr >> 8) & 0xFF,
 753                                         (bin->edbgConfig.ppshIPAddr >> 16) & 0xFF,
 754                                         (bin->edbgConfig.ppshIPAddr >> 24) & 0xFF,
 755                                         ntohs(bin->edbgConfig.ppshPort));
 756                         }
 757
 758                         if (bin->edbgConfig.flags & EDBG_FL_KDBG) {
 759                                 printf("--> Enabling KDBG service, IP: %d.%d.%d.%d, port: %d\n",
 760                                         (bin->edbgConfig.kdbgIPAddr >> 0) & 0xFF,
 761                                         (bin->edbgConfig.kdbgIPAddr >> 8) & 0xFF,
 762                                         (bin->edbgConfig.kdbgIPAddr >> 16) & 0xFF,
 763                                         (bin->edbgConfig.kdbgIPAddr >> 24) & 0xFF,
 764                                         ntohs(bin->edbgConfig.kdbgPort));
 765                         }
 766
 767                         if (bin->edbgConfig.flags & EDBG_FL_CLEANBOOT) {
 768                                 printf("--> Force clean boot\n");
 769                         }
 770                 }
 771                 ret = BOOTME_DEBUG;
 772                 break;
 773
 774         default:
 775                 if (net->verbose) {
 776                         printf("Received unknown command: %08X\n", header.cmd);
 777                 }
 778                 return BOOTME_ERROR;
 779         }
 780
 781         /* Respond with ack */
 782         header.flags = EDBG_FL_FROM_DEV | EDBG_FL_ACK;
 783         net->dataLen = EDBG_DATA_OFFSET;
 784 debug("%s@%d: sending packet %p len %u\n", __func__, __LINE__,
 785         net->data, net->dataLen);
 786         bootme_send_frame(net->data, net->dataLen);
 787         return ret;
 788 }
 789
 790 static enum bootme_state ce_edbg_handler(const void *buf, size_t len)
 791 {
 792         if (len == 0)
 793                 return BOOTME_DONE;
 794
 795         g_net.data = (void *)buf;
 796         g_net.dataLen = len;
 797
 798         return ce_process_edbg(&g_net, &g_bin);
 799 }
 800
 801 static void ce_init_edbg_link(ce_net *net)
 802 {
 803         /* Initialize EDBG link for commands */
 804         net->state = BOOTME_INIT;
 805 }
 806
 807 static enum bootme_state ce_download_handler(const void *buf, size_t len)
 808 {
 809         g_net.data = (void *)buf;
 810         g_net.dataLen = len;
 811
 812         g_net.state = ce_process_download(&g_net, &g_bin);
 813         return g_net.state;
 814 }
 815
 816 static int ce_send_bootme(ce_net *net)
 817 {
 818         eth_dbg_hdr *header;
 819         edbg_bootme_data *data;
 820         unsigned char txbuf[PKTSIZE_ALIGN];
 821 #ifdef DEBUG
 822         int     i;
 823         unsigned char   *pkt;
 824 #endif
 825         /* Fill out BOOTME packet */
 826         net->data = txbuf;
 827
 828         memset(net->data, 0, PKTSIZE);
 829         header = (eth_dbg_hdr *)net->data;
 830         data = (edbg_bootme_data *)header->data;
 831
 832         header->id = EDBG_ID;
 833         header->service = EDBG_SVC_ADMIN;
 834         header->flags = EDBG_FL_FROM_DEV;
 835         header->seqNum = net->seqNum++;
 836         header->cmd = EDBG_CMD_BOOTME;
 837
 838         data->versionMajor = 0;
 839         data->versionMinor = 0;
 840         data->cpuId = EDBG_CPU_TYPE_ARM;
 841         data->bootmeVer = EDBG_CURRENT_BOOTME_VERSION;
 842         data->bootFlags = 0;
 843         data->downloadPort = 0;
 844         data->svcPort = 0;
 845
 846         /* MAC address from environment*/
 847         if (!eth_getenv_enetaddr("ethaddr", data->macAddr)) {
 848                 printf("'ethaddr' is not set or invalid\n");
 849                 memset(data->macAddr, 0, sizeof(data->macAddr));
 850         }
 851
 852         /* IP address from active config */
 853         NetCopyIP(&data->ipAddr, &NetOurIP);
 854
 855         // Device name string (NULL terminated). Should include
 856         // platform and number based on Ether address (e.g. Odo42, CEPCLS2346, etc)
 857
 858         // We will use lower MAC address segment to create device name
 859         // eg. MAC '00-0C-C6-69-09-05', device name 'Triton05'
 860
 861         strncpy(data->platformId, "Triton", sizeof(data->platformId));
 862         snprintf(data->deviceName, sizeof(data->deviceName), "%s%02X",
 863                 data->platformId, data->macAddr[5]);
 864
 865 #ifdef DEBUG
 866         printf("header->id: %08X\r\n", header->id);
 867         printf("header->service: %08X\r\n", header->service);
 868         printf("header->flags: %08X\r\n", header->flags);
 869         printf("header->seqNum: %08X\r\n", header->seqNum);
 870         printf("header->cmd: %08X\r\n\r\n", header->cmd);
 871
 872         printf("data->versionMajor: %08X\r\n", data->versionMajor);
 873         printf("data->versionMinor: %08X\r\n", data->versionMinor);
 874         printf("data->cpuId: %08X\r\n", data->cpuId);
 875         printf("data->bootmeVer: %08X\r\n", data->bootmeVer);
 876         printf("data->bootFlags: %08X\r\n", data->bootFlags);
 877         printf("data->svcPort: %08X\r\n\r\n", ntohs(data->svcPort));
 878
 879         printf("data->macAddr: %02X-%02X-%02X-%02X-%02X-%02X\r\n",
 880                 data->macAddr[0], data->macAddr[1],
 881                 data->macAddr[2], data->macAddr[3],
 882                 data->macAddr[4], data->macAddr[5]);
 883
 884         printf("data->ipAddr: %d.%d.%d.%d\r\n",
 885                 (data->ipAddr >> 0) & 0xFF,
 886                 (data->ipAddr >> 8) & 0xFF,
 887                 (data->ipAddr >> 16) & 0xFF,
 888                 (data->ipAddr >> 24) & 0xFF);
 889
 890         printf("data->platformId: %s\r\n", data->platformId);
 891
 892         printf("data->deviceName: %s\r\n", data->deviceName);
 893 #endif
 894         // Some diag output ...
 895         if (net->verbose) {
 896                 printf("Sending BOOTME request [%d] to %pI4\n", net->seqNum,
 897                         &server_ip);
 898         }
 899
 900         net->dataLen = BOOTME_PKT_SIZE;
 901 //      net->status = CE_PR_MORE;
 902         net->state = BOOTME_INIT;
 903 #ifdef DEBUG
 904         debug("Start of buffer:      %p\n", net->data);
 905         debug("Start of ethernet buffer:   %p\n", net->data);
 906         debug("Start of CE header:         %p\n", header);
 907         debug("Start of CE data:           %p\n", data);
 908
 909         pkt = net->data;
 910         debug("packet to send (ceconnect): \n");
 911         for (i = 0; i < net->dataLen; i++) {
 912                 debug("0x%02X ", pkt[i]);
 913                 if (!((i + 1) % 16))
 914                         debug("\n");
 915         }
 916         debug("\n");
 917 #endif
 918         return BootMeRequest(server_ip, net->data, net->dataLen, 1);
 919 }
 920
 921 static inline int ce_init_download_link(ce_net *net, ce_bin *bin, int verbose)
 922 {
 923         if (!eth_get_dev()) {
 924                 printf("No network interface available\n");
 925                 return -ENODEV;
 926         }
 927         printf("Using device '%s'\n", eth_get_name());
 928
 929         /* Initialize EDBG link for download */
 930         memset(net, 0, sizeof(*net));
 931
 932         net->verbose = verbose;
 933
 934         /* buffer will be dynamically assigned in ce_download_handler() */
 935         ce_init_bin(bin, NULL);
 936         return 0;
 937 }
 938
 939 #define UINT_MAX ~0UL
 940
 941 static inline int ce_download_file(ce_net *net, ulong timeout)
 942 {
 943         ulong start = get_timer_masked();
 944
 945         while (net->state == BOOTME_INIT) {
 946                 int ret;
 947
 948                 if (timeout && get_timer(start) > timeout) {
 949                         printf("CELOAD - Canceled, timeout\n");
 950                         return 1;
 951                 }
 952
 953                 if (ctrlc()) {
 954                         printf("CELOAD - canceled by user\n");
 955                         return 1;
 956                 }
 957
 958                 if (ce_send_bootme(&g_net)) {
 959                         printf("CELOAD - error while sending BOOTME request\n");
 960                         return 1;
 961                 }
 962                 if (net->verbose) {
 963                         if (timeout) {
 964                                 printf("Waiting for connection, timeout %lu sec\n",
 965                                         DIV_ROUND_UP(timeout - get_timer(start),
 966                                                 CONFIG_SYS_HZ));
 967                         } else {
 968                                 printf("Waiting for connection, enter ^C to abort\n");
 969                         }
 970                 }
 971
 972                 ret = BootMeDownload(ce_download_handler);
 973                 if (ret == BOOTME_ERROR) {
 974                         printf("CELOAD - aborted\n");
 975                         return 1;
 976                 }
 977         }
 978         return 0;
 979 }
 980
 981 static void ce_disconnect(void)
 982 {
 983         net_set_udp_handler(NULL);
 984         eth_halt();
 985 }
 986
 987 static int do_ceconnect(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 988 {
 989         int verbose = 0;
 990         ulong timeout = 0;
 991         int ret = 1;
 992         int i;
 993
 994         server_ip = 0;
 995
 996         for (i = 1; i < argc; i++){
 997                 if (*argv[i] != '-')
 998                         break;
 999                 if (argv[i][1] == 'v') {
1000                         verbose = 1;
1001                 } else if (argv[i][1] == 't') {
1002                         i++;
1003                         if (argc > i) {
1004                                 timeout = simple_strtoul(argv[i],
1005                                                         NULL, 10);
1006                                 if (timeout >= UINT_MAX / CONFIG_SYS_HZ) {
1007                                         printf("Timeout value %lu out of range (max.: %lu)\n",
1008                                                 timeout, UINT_MAX / CONFIG_SYS_HZ - 1);
1009                                         return CMD_RET_USAGE;
1010                                 }
1011                                 timeout *= CONFIG_SYS_HZ;
1012                         } else {
1013                                 printf("Option requires an argument - t\n");
1014                                 return CMD_RET_USAGE;
1015                         }
1016                 } else if (argv[i][1] == 'h') {
1017                         i++;
1018                         if (argc > i) {
1019                                 server_ip = string_to_ip(argv[i]);
1020                                 printf("Using server %pI4\n", &server_ip);
1021                         } else {
1022                                 printf("Option requires an argument - t\n");
1023                                 return CMD_RET_USAGE;
1024                         }
1025                 }
1026         }
1027
1028         if (ce_init_download_link(&g_net, &g_bin, verbose) != 0)
1029                 goto err;
1030
1031         if (ce_download_file(&g_net, timeout))
1032                 goto err;
1033
1034         if (g_bin.binLen) {
1035                 // Try to receive edbg commands from host
1036                 ce_init_edbg_link(&g_net);
1037                 if (verbose)
1038                         printf("Waiting for EDBG commands ...\n");
1039
1040                 ret = BootMeDebugStart(ce_edbg_handler);
1041                 if (ret != BOOTME_DONE)
1042                         goto err;
1043
1044                 // Prepare WinCE image for execution
1045                 ce_prepare_run_bin(&g_bin);
1046
1047                 // Launch WinCE, if necessary
1048                 if (g_net.gotJumpingRequest)
1049                         ce_run_bin(g_bin.eEntryPoint);
1050         }
1051         ret = 0;
1052 err:
1053         ce_disconnect();
1054         return ret == 0 ? CMD_RET_SUCCESS : CMD_RET_FAILURE;
1055 }
1056 U_BOOT_CMD(
1057         ceconnect, 6, 1, do_ceconnect,
1058         "Set up a connection to the CE host PC over TCP/IP and download the run-time image\n",
1059         "[-v] [-t <timeout>] [-h host]\n"
1060         "  -v            - verbose operation\n"
1061         "  -t <timeout>  - max wait time (#sec) for the connection\n"
1062         "  -h <host>     - send BOOTME requests to <host> (default: broadcast address 255.255.255.255)"
1063 );