RTL DA/E flasher stub (#2140)

2026-08-18 02:54:53 +00:00 · 2026-06-20 09:55:14 +03:00
parent aa1140fff3
commit c77fd8945a
8 changed files with 1429 additions and 0 deletions
--- a/platforms/RTL8720E/flasher_stub/.gitignore
+++ b/platforms/RTL8720E/flasher_stub/.gitignore
@ -0,0 +1 @@
+RTL8720E_Stub.bin
--- a/platforms/RTL8720E/flasher_stub/CMakeLists.txt
+++ b/platforms/RTL8720E/flasher_stub/CMakeLists.txt
@ -0,0 +1,199 @@
+set_property(GLOBAL PROPERTY ALLOW_DUPLICATE_CUSTOM_TARGETS TRUE)
+ameba_add_image(target_floader p_EXCLUDE_FROM_ALL)
+# variable c_CURRENT_IMAGE value is target_loader_${PROJECT_NAME}
+
+###############################  ADD COMPONENT  ###################################
+
+ameba_add_subdirectory(${c_CMPT_CRASHDUMP_DIR})
+ameba_add_subdirectory(${c_CMPT_CHIPINFO_DIR})
+ameba_add_subdirectory(${c_CMPT_SOC_DIR}/lib/bootloader lib_bootloader)
+ameba_add_subdirectory(${c_CMPT_FILE_SYSTEM_DIR})
+ameba_add_subdirectory(${c_CMPT_OS_DIR}/freertos/os_wrapper)
+
+###############################  GENERATE IMAGE  ###################################
+#---------------- PRE LINK -------------------#
+
+add_custom_command(
+  TARGET ${c_CURRENT_IMAGE} PRE_LINK
+  COMMAND ${CMAKE_C_COMPILER} -E -P -xc -c -DGENERATE_FLOADER_LD ${CMAKE_CURRENT_SOURCE_DIR}/../../RTL8721DA/flasher_stub/stub.ld -I ${c_SOC_PROJECT_DIR} -o ${CMAKE_CURRENT_BINARY_DIR}/rlx8721d.ld -I ${c_MENUCONFIG_DIR}
+  COMMAND ${CMAKE_COMMAND} -E cat ${c_LINK_ROM_SYMBOL_S} >> ${CMAKE_CURRENT_BINARY_DIR}/rlx8721d.ld
+  COMMENT "build flashloader linkerscript rlx8721d.ld"
+)
+
+#----------------- LINKING -------------------#
+
+target_link_libraries(${c_CURRENT_IMAGE}
+	PRIVATE
+	-T${CMAKE_CURRENT_BINARY_DIR}/rlx8721d.ld
+	${c_MCU_PROJ_CONFIG}
+	-Wl,--gc-sections
+	-Wl,-Map=${CMAKE_CURRENT_BINARY_DIR}/text.map
+	-Wl,--whole-archive
+	$<TARGET_PROPERTY:${c_MCU_PROJ_CONFIG},${c_CURRENT_IMAGE}_libraries>
+	$<TARGET_PROPERTY:${c_MCU_PROJ_CONFIG},${c_CURRENT_IMAGE}_whole_archive_libs>
+	-Wl,--no-whole-archive
+
+	$<TARGET_PROPERTY:${c_MCU_PROJ_CONFIG},${c_CURRENT_IMAGE}_no_whole_archive_libs>
+
+	${c_LINK_ROM_LIB}
+)
+#--------------- POST BUILD ------------------#
+
+add_custom_command(TARGET ${c_CURRENT_IMAGE} POST_BUILD
+	COMMAND ${CMAKE_COMMAND} -E make_directory ${c_SDK_IMAGE_TARGET_DIR}
+	COMMAND ${CMAKE_COMMAND} -E touch ${c_SDK_IMAGE_TARGET_DIR}/.gitignore
+	COMMAND ${CMAKE_COMMAND} -E copy text.map ${c_SDK_IMAGE_TARGET_DIR}/text_loader.map
+	COMMAND ${CMAKE_COMMAND} -E copy ${c_CURRENT_IMAGE}.axf ${c_SDK_IMAGE_TARGET_DIR}/target_loader.axf
+	COMMAND ${CMAKE_NM} ${c_SDK_IMAGE_TARGET_DIR}/target_loader.axf | sort > ${c_SDK_IMAGE_TARGET_DIR}/target_loader.map
+	COMMAND ${CMAKE_OBJDUMP} -d ${c_SDK_IMAGE_TARGET_DIR}/target_loader.axf > ${c_SDK_IMAGE_TARGET_DIR}/target_loader.asm
+	COMMAND ${CMAKE_COMMAND} -E copy ${c_SDK_IMAGE_TARGET_DIR}/target_loader.axf ${c_SDK_IMAGE_TARGET_DIR}/target_pure_loader.axf
+	COMMAND ${CMAKE_STRIP} ${c_SDK_IMAGE_TARGET_DIR}/target_pure_loader.axf
+
+	COMMAND ${CMAKE_COMMAND} -E echo "  BIN      stub.bin"
+
+	COMMAND ${CMAKE_COMMAND}
+		# common variables
+		-Dc_BASEDIR=${c_BASEDIR}  # dir of sdk's root
+		-Dc_CMAKE_FILES_DIR=${c_CMAKE_FILES_DIR} # dir of cmake scripts
+		-Dc_SOC_PROJECT_DIR=${c_SOC_PROJECT_DIR} # dir of soc project
+		-Dc_MCU_PROJECT_DIR=${c_MCU_PROJECT_DIR} # dir of current mcu project
+		-Dc_MCU_PROJECT_NAME=${c_MCU_PROJECT_NAME} # name of current mcu project
+		-Dc_MCU_KCONFIG_FILE=${c_MCU_KCONFIG_FILE} # file of current project's kconfig file
+		-Dc_SDK_IMAGE_TARGET_DIR=${c_SDK_IMAGE_TARGET_DIR} # dir of image output
+
+		# user's variables
+		-DFINAL_IMAGE_DIR=${FINAL_IMAGE_DIR}
+		-DBUILD_TYPE=${BUILD_TYPE}
+		-DANALYZE_MP_IMG=${ANALYZE_MP_IMG}
+		-DDAILY_BUILD=${DAILY_BUILD}
+		-DEXTERN_DIR=${EXTERN_DIR}
+
+		# special variables for current image
+		-DIMGTOOL_LOADER=y
+
+		# cmake toolchain variables
+		-DIMAGESCRIPTDIR=${IMAGESCRIPTDIR}
+		-DCMAKE_SIZE=${CMAKE_SIZE}
+		-DCMAKE_OBJCOPY=${CMAKE_OBJCOPY}
+
+		-P ${c_SDK_IMAGE_TARGET_DIR}/../make/image1/${c_POST_BUILD_SCRIPT}
+
+	COMMAND ${CMAKE_COMMAND} -E copy ${c_SDK_IMAGE_TARGET_DIR}/ram_1.bin           ${CMAKE_CURRENT_SOURCE_DIR}/stub.bin
+	COMMAND gzip ${CMAKE_CURRENT_SOURCE_DIR}/stub.bin
+	COMMAND mv ${CMAKE_CURRENT_SOURCE_DIR}/stub.bin.gz ${CMAKE_CURRENT_SOURCE_DIR}/RTL8720E_Stub.bin
+)
+
+
+################################  EXTRA PROCESS  ###################################
+set(clean_files
+)
+
+set(link_deps
+	${c_LAYOUT_LD}
+	${c_IMG1_LD}
+	${c_LINK_ROM_SYMBOL_S}
+)
+
+set_target_properties(${c_CURRENT_IMAGE} PROPERTIES
+	#WARNING: values for these parameter MUST be placed inside a pair of quotes
+	# ADDITIONAL_CLEAN_FILES
+	#     "${clean_files}"
+	LINK_DEPENDS
+		"${link_deps}"
+)
+################################  CUSTOM TARGET  ###################################
+
+add_custom_target(
+	flashloader
+	COMMENT "build flashloader only"
+	DEPENDS ${c_CURRENT_IMAGE}
+)
+set(public_includes)                #public include directories, NOTE: relative path is OK
+set(public_definitions)             #public definitions
+set(public_libraries)               #public libraries(files), NOTE: linked with whole-archive options
+
+#----------------------------------------#
+# Component public part, user config begin
+
+# You may use if-else condition to set or update predefined variable above
+
+# Component public part, user config end
+#----------------------------------------#
+
+#WARNING: Fixed section, DO NOT change!
+ameba_global_include(${public_includes})
+ameba_global_define(${public_definitions})
+ameba_global_library(${public_libraries}) #default: whole-archived
+
+##########################################################################################
+## * This part defines private part of the component
+## * Private part is used to build target of current component
+## * NOTE: The build API guarantees the global build configures(mentioned above)
+## *       applied to the target automatically. So if any configure was already added
+## *       to public above, it's unnecessary to add again below.
+
+#NOTE: User defined section, add your private build configures here
+# You may use if-else condition to set these predefined variable
+# They are only for ameba_add_internal_library/ameba_add_external_app_library/ameba_add_external_soc_library
+set(private_sources)                 #private source files, NOTE: relative path is OK
+set(private_includes)                #private include directories, NOTE: relative path is OK
+set(private_definitions)             #private definitions
+set(private_compile_options)         #private compile_options
+
+#------------------------------#
+# Component private part, user config begin
+
+ameba_list_append(private_sources
+	../../RTL8721DA/flasher_stub/flasher_stub.c
+	${c_CMPT_SWLIB_DIR}/log.c
+	${c_CMPT_FWLIB_DIR}/ram_km4/ameba_arch.c
+	${c_CMPT_FWLIB_DIR}/ram_common/ameba_otp.c
+#	${c_CMPT_FWLIB_DIR}/ram_common/ameba_ipc_ram.c
+	${c_BASEDIR}/component/soc/usrcfg/amebalite/ameba_bootcfg.c
+	${c_BASEDIR}/component/soc/usrcfg/amebalite/ameba_flashcfg.c
+	${c_CMPT_SOC_DIR}/hal/src/flash_api.c
+	${c_CMPT_SOC_DIR}/misc/ameba_pmu.c
+)
+
+ameba_list_append(private_sources
+	${c_FREERTOS_DIR}/tasks.c
+	${c_FREERTOS_DIR}/list.c
+	${c_FREERTOS_DIR}/croutine.c
+	${c_FREERTOS_DIR}/queue.c
+	${c_FREERTOS_DIR}/timers.c
+	${c_FREERTOS_DIR}/event_groups.c
+	${c_FREERTOS_DIR}/stream_buffer.c
+	${c_FREERTOS_DIR}/portable/MemMang/heap_5.c
+)
+
+set(portable_soc_mcu_dir ${c_FREERTOS_DIR}/portable/GCC/${c_SOC_TYPE_CAMEL}_${c_MCU_TYPE_UPPER})
+ameba_list_append(private_sources
+	${portable_soc_mcu_dir}/non_secure/port.c
+	${portable_soc_mcu_dir}/non_secure/portasm.c
+)
+# Component private part, user config end
+#------------------------------#
+
+#WARNING: Select right API based on your component's release/not-release/standalone
+
+###NOTE: For open-source component, always build from source
+ameba_add_internal_library(flashloader
+	p_SOURCES
+		${private_sources}
+	p_INCLUDES
+		${private_includes}
+	p_DEFINITIONS
+		${private_definitions}
+	p_COMPILE_OPTIONS
+		${private_compile_options}
+	p_DEPENDENCIES
+		${c_BUILD_INFO}
+)
+
+target_compile_options(
+	${c_MCU_PROJ_CONFIG} INTERFACE
+	-Os
+	-DLFS_NO_DEBUG -DLFS_NO_WARN -DLFS_NO_ERROR -DLFS_NO_ASSERT
+)
+
+##########################################################################################
--- a/platforms/RTL8720E/flasher_stub/Makefile
+++ b/platforms/RTL8720E/flasher_stub/Makefile
@ -0,0 +1,9 @@
+.PHONY: all build clean
+
+all: build
+
+build:
+	cd ../../../sdk/ameba-rtos/amebalite_gcc_project && ./build.py -a ../../../platforms/RTL8720E/flasher_stub -g flashloader
+
+clean:
+	rm RTL8720E_Stub.bin
--- a/platforms/RTL8721DA/flasher_stub/.gitignore
+++ b/platforms/RTL8721DA/flasher_stub/.gitignore
@ -0,0 +1 @@
+RTL8721DA_Stub.bin
--- a/platforms/RTL8721DA/flasher_stub/CMakeLists.txt
+++ b/platforms/RTL8721DA/flasher_stub/CMakeLists.txt
@ -0,0 +1,199 @@
+set_property(GLOBAL PROPERTY ALLOW_DUPLICATE_CUSTOM_TARGETS TRUE)
+ameba_add_image(target_floader p_EXCLUDE_FROM_ALL)
+# variable c_CURRENT_IMAGE value is target_loader_${PROJECT_NAME}
+
+###############################  ADD COMPONENT  ###################################
+
+ameba_add_subdirectory(${c_CMPT_CRASHDUMP_DIR})
+ameba_add_subdirectory(${c_CMPT_CHIPINFO_DIR})
+ameba_add_subdirectory(${c_CMPT_SOC_DIR}/lib/bootloader lib_bootloader)
+ameba_add_subdirectory(${c_CMPT_FILE_SYSTEM_DIR})
+ameba_add_subdirectory(${c_CMPT_OS_DIR}/freertos/os_wrapper)
+
+###############################  GENERATE IMAGE  ###################################
+#---------------- PRE LINK -------------------#
+
+add_custom_command(
+  TARGET ${c_CURRENT_IMAGE} PRE_LINK
+  COMMAND ${CMAKE_C_COMPILER} -E -P -xc -c -DGENERATE_FLOADER_LD ${CMAKE_CURRENT_SOURCE_DIR}/stub.ld -I ${c_SOC_PROJECT_DIR} -o ${CMAKE_CURRENT_BINARY_DIR}/rlx8721d.ld -I ${c_MENUCONFIG_DIR}
+  COMMAND ${CMAKE_COMMAND} -E cat ${c_LINK_ROM_SYMBOL_S} >> ${CMAKE_CURRENT_BINARY_DIR}/rlx8721d.ld
+  COMMENT "build flashloader linkerscript rlx8721d.ld"
+)
+
+#----------------- LINKING -------------------#
+
+target_link_libraries(${c_CURRENT_IMAGE}
+	PRIVATE
+	-T${CMAKE_CURRENT_BINARY_DIR}/rlx8721d.ld
+	${c_MCU_PROJ_CONFIG}
+	-Wl,--gc-sections
+	-Wl,-Map=${CMAKE_CURRENT_BINARY_DIR}/text.map
+	-Wl,--whole-archive
+	$<TARGET_PROPERTY:${c_MCU_PROJ_CONFIG},${c_CURRENT_IMAGE}_libraries>
+	$<TARGET_PROPERTY:${c_MCU_PROJ_CONFIG},${c_CURRENT_IMAGE}_whole_archive_libs>
+	-Wl,--no-whole-archive
+
+	$<TARGET_PROPERTY:${c_MCU_PROJ_CONFIG},${c_CURRENT_IMAGE}_no_whole_archive_libs>
+
+	${c_LINK_ROM_LIB}
+)
+#--------------- POST BUILD ------------------#
+
+add_custom_command(TARGET ${c_CURRENT_IMAGE} POST_BUILD
+	COMMAND ${CMAKE_COMMAND} -E make_directory ${c_SDK_IMAGE_TARGET_DIR}
+	COMMAND ${CMAKE_COMMAND} -E touch ${c_SDK_IMAGE_TARGET_DIR}/.gitignore
+	COMMAND ${CMAKE_COMMAND} -E copy text.map ${c_SDK_IMAGE_TARGET_DIR}/text_loader.map
+	COMMAND ${CMAKE_COMMAND} -E copy ${c_CURRENT_IMAGE}.axf ${c_SDK_IMAGE_TARGET_DIR}/target_loader.axf
+	COMMAND ${CMAKE_NM} ${c_SDK_IMAGE_TARGET_DIR}/target_loader.axf | sort > ${c_SDK_IMAGE_TARGET_DIR}/target_loader.map
+	COMMAND ${CMAKE_OBJDUMP} -d ${c_SDK_IMAGE_TARGET_DIR}/target_loader.axf > ${c_SDK_IMAGE_TARGET_DIR}/target_loader.asm
+	COMMAND ${CMAKE_COMMAND} -E copy ${c_SDK_IMAGE_TARGET_DIR}/target_loader.axf ${c_SDK_IMAGE_TARGET_DIR}/target_pure_loader.axf
+	COMMAND ${CMAKE_STRIP} ${c_SDK_IMAGE_TARGET_DIR}/target_pure_loader.axf
+
+	COMMAND ${CMAKE_COMMAND} -E echo "  BIN      stub.bin"
+
+	COMMAND ${CMAKE_COMMAND}
+		# common variables
+		-Dc_BASEDIR=${c_BASEDIR}  # dir of sdk's root
+		-Dc_CMAKE_FILES_DIR=${c_CMAKE_FILES_DIR} # dir of cmake scripts
+		-Dc_SOC_PROJECT_DIR=${c_SOC_PROJECT_DIR} # dir of soc project
+		-Dc_MCU_PROJECT_DIR=${c_MCU_PROJECT_DIR} # dir of current mcu project
+		-Dc_MCU_PROJECT_NAME=${c_MCU_PROJECT_NAME} # name of current mcu project
+		-Dc_MCU_KCONFIG_FILE=${c_MCU_KCONFIG_FILE} # file of current project's kconfig file
+		-Dc_SDK_IMAGE_TARGET_DIR=${c_SDK_IMAGE_TARGET_DIR} # dir of image output
+
+		# user's variables
+		-DFINAL_IMAGE_DIR=${FINAL_IMAGE_DIR}
+		-DBUILD_TYPE=${BUILD_TYPE}
+		-DANALYZE_MP_IMG=${ANALYZE_MP_IMG}
+		-DDAILY_BUILD=${DAILY_BUILD}
+		-DEXTERN_DIR=${EXTERN_DIR}
+
+		# special variables for current image
+		-DIMGTOOL_LOADER=y
+
+		# cmake toolchain variables
+		-DIMAGESCRIPTDIR=${IMAGESCRIPTDIR}
+		-DCMAKE_SIZE=${CMAKE_SIZE}
+		-DCMAKE_OBJCOPY=${CMAKE_OBJCOPY}
+
+		-P ${c_SDK_IMAGE_TARGET_DIR}/../make/image1/${c_POST_BUILD_SCRIPT}
+
+	COMMAND ${CMAKE_COMMAND} -E copy ${c_SDK_IMAGE_TARGET_DIR}/ram_1.bin           ${CMAKE_CURRENT_SOURCE_DIR}/stub.bin
+	COMMAND gzip ${CMAKE_CURRENT_SOURCE_DIR}/stub.bin
+	COMMAND mv ${CMAKE_CURRENT_SOURCE_DIR}/stub.bin.gz ${CMAKE_CURRENT_SOURCE_DIR}/RTL8721DA_Stub.bin
+)
+
+
+################################  EXTRA PROCESS  ###################################
+set(clean_files
+)
+
+set(link_deps
+	${c_LAYOUT_LD}
+	${c_IMG1_LD}
+	${c_LINK_ROM_SYMBOL_S}
+)
+
+set_target_properties(${c_CURRENT_IMAGE} PROPERTIES
+	#WARNING: values for these parameter MUST be placed inside a pair of quotes
+	# ADDITIONAL_CLEAN_FILES
+	#     "${clean_files}"
+	LINK_DEPENDS
+		"${link_deps}"
+)
+################################  CUSTOM TARGET  ###################################
+
+add_custom_target(
+	flashloader
+	COMMENT "build flashloader only"
+	DEPENDS ${c_CURRENT_IMAGE}
+)
+set(public_includes)                #public include directories, NOTE: relative path is OK
+set(public_definitions)             #public definitions
+set(public_libraries)               #public libraries(files), NOTE: linked with whole-archive options
+
+#----------------------------------------#
+# Component public part, user config begin
+
+# You may use if-else condition to set or update predefined variable above
+
+# Component public part, user config end
+#----------------------------------------#
+
+#WARNING: Fixed section, DO NOT change!
+ameba_global_include(${public_includes})
+ameba_global_define(${public_definitions})
+ameba_global_library(${public_libraries}) #default: whole-archived
+
+##########################################################################################
+## * This part defines private part of the component
+## * Private part is used to build target of current component
+## * NOTE: The build API guarantees the global build configures(mentioned above)
+## *       applied to the target automatically. So if any configure was already added
+## *       to public above, it's unnecessary to add again below.
+
+#NOTE: User defined section, add your private build configures here
+# You may use if-else condition to set these predefined variable
+# They are only for ameba_add_internal_library/ameba_add_external_app_library/ameba_add_external_soc_library
+set(private_sources)                 #private source files, NOTE: relative path is OK
+set(private_includes)                #private include directories, NOTE: relative path is OK
+set(private_definitions)             #private definitions
+set(private_compile_options)         #private compile_options
+
+#------------------------------#
+# Component private part, user config begin
+
+ameba_list_append(private_sources
+	flasher_stub.c
+	${c_CMPT_SWLIB_DIR}/log.c
+	${c_CMPT_FWLIB_DIR}/ram_common/ameba_arch.c
+	${c_CMPT_FWLIB_DIR}/ram_common/ameba_pll.c
+	${c_CMPT_FWLIB_DIR}/ram_common/ameba_ldo.c
+	${c_BASEDIR}/component/soc/usrcfg/amebadplus/ameba_bootcfg.c
+	${c_BASEDIR}/component/soc/usrcfg/amebadplus/ameba_flashcfg.c
+	${c_CMPT_SOC_DIR}/hal/src/flash_api.c
+	${c_CMPT_SOC_DIR}/misc/ameba_pmu.c
+)
+
+ameba_list_append(private_sources
+	${c_FREERTOS_DIR}/tasks.c
+	${c_FREERTOS_DIR}/list.c
+	${c_FREERTOS_DIR}/croutine.c
+	${c_FREERTOS_DIR}/queue.c
+	${c_FREERTOS_DIR}/timers.c
+	${c_FREERTOS_DIR}/event_groups.c
+	${c_FREERTOS_DIR}/stream_buffer.c
+	${c_FREERTOS_DIR}/portable/MemMang/heap_5.c
+)
+
+set(portable_soc_mcu_dir ${c_FREERTOS_DIR}/portable/GCC/${c_SOC_TYPE_CAMEL}_${c_MCU_TYPE_UPPER})
+ameba_list_append(private_sources
+	${portable_soc_mcu_dir}/non_secure/port.c
+	${portable_soc_mcu_dir}/non_secure/portasm.c
+)
+# Component private part, user config end
+#------------------------------#
+
+#WARNING: Select right API based on your component's release/not-release/standalone
+
+###NOTE: For open-source component, always build from source
+ameba_add_internal_library(flashloader
+	p_SOURCES
+		${private_sources}
+	p_INCLUDES
+		${private_includes}
+	p_DEFINITIONS
+		${private_definitions}
+	p_COMPILE_OPTIONS
+		${private_compile_options}
+	p_DEPENDENCIES
+		${c_BUILD_INFO}
+)
+
+target_compile_options(
+	${c_MCU_PROJ_CONFIG} INTERFACE
+	-Os
+	-DLFS_NO_DEBUG -DLFS_NO_WARN -DLFS_NO_ERROR -DLFS_NO_ASSERT
+)
+
+##########################################################################################
--- a/platforms/RTL8721DA/flasher_stub/Makefile
+++ b/platforms/RTL8721DA/flasher_stub/Makefile
@ -0,0 +1,9 @@
+.PHONY: all build clean
+
+all: build
+
+build:
+	cd ../../../sdk/ameba-rtos/amebadplus_gcc_project && ./build.py -a ../../../platforms/RTL8721DA/flasher_stub -g flashloader
+
+clean:
+	rm RTL8721DA_Stub.bin
--- a/platforms/RTL8721DA/flasher_stub/flasher_stub.c
+++ b/platforms/RTL8721DA/flasher_stub/flasher_stub.c
@ -0,0 +1,908 @@
+#include "ameba.h"
+#include "FreeRTOS.h"
+#include "build_info.h"
+#include <stdint.h>
+#include <stdio.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <string.h>
+#include "ssl_rom_to_ram_map.h"
+#include "rtk_compiler.h"
+#include "ameba_cache.h"
+#include <vfs.h>
+#include <kv.h>
+
+#define MAGIC 						0xA5
+#define ACK_MAGIC 					0x5A 
+
+#define STATE_ERR					0xFF
+#define STATE_SYN					0x00
+#define STATE_RAM_DOWNLOAD			0x01
+#define STATE_FLASH_DOWNLOAD		0x02
+#define STATE_FLASH_UPLOAD			0x03
+#define STATE_FLASH_ERASE			0x04
+#define STATE_FLASH_CHIPERASE		0x05
+#define STATE_RUN					0x06
+#define STATE_BOUND					0x07
+#define STATE_MAX					0x08
+
+#define STATUS_SUCCESS				0x00
+#define STATUS_ERROR				0x01
+#define STATUS_ADDR_ERROR			0x02
+#define STATUS_TYPE_ERROR			0x03
+#define STATUS_LEN_ERROR			0x04
+#define STATUS_CRC_ERROR			0x05
+
+#define RESPONSE_FAIL				0xFF
+#define RESPONSE_OK					0x00
+#define RESPONSE_SYNC_BOOTROM		0x01
+#define RESPONSE_SYNC_SBL			0x02
+
+#define ACK_OK  0x00
+#define ACK_ERR 0x01
+
+#define MSG_OK 0x00
+#define MSG_ERR -1
+
+#define SYNC_REQUEST_VALUE			0x73796E63
+#define SYNC_REQUEST_SIZE			0x04
+#define SYNC_REQUEST_TIMEOUT		120
+
+#define HEAD_SIZE					4
+#define CFG_SIZE					8
+#define ACK_SIZE					6
+#define CMD_DATA_MAX_LEN 			(4 + 1 + 1024*64 + 2)
+#define RESPONSE_SIZE				0x01
+#define LOAD_MAX_SIZE_BIG			0x10000
+
+struct sburner_cmd
+{
+	unsigned int msg_type;
+	unsigned int arg0;
+	unsigned int arg1;
+};
+
+struct message_rec_head
+{
+	unsigned char magic;
+	unsigned char type;
+	unsigned short data_len;
+	unsigned int run_addr;
+	unsigned char CRC8;
+};
+
+#define MESSAGE_REC_SIZE sizeof(struct message_rec_head)
+
+struct message_ack_head
+{
+	unsigned char magic;
+	unsigned char type;
+	unsigned short data_len;
+	unsigned char status;
+	unsigned char CRC8;
+};
+#define MESSAGE_ACK_SIZE sizeof(struct message_ack_head)
+
+struct load_cfg_msg
+{
+	unsigned int	addr;
+	unsigned int	len;
+} load_cfg_msg_t;
+#define MESSAGE_LOAD_SIZE sizeof(struct load_cfg_msg)
+
+#pragma pack(1)
+typedef struct message_head
+{
+	uint8_t sof;
+	uint8_t type;
+	uint32_t data_len;
+	uint8_t sub_type;
+	uint32_t check_sum;
+} message_head_t;
+#pragma pack()
+
+struct download_cfg_msg
+{
+	int msg_type;
+	int addr;
+	int len;
+};
+
+struct download_t
+{
+	int download_state;
+	int download_addr;
+	int download_len;
+	int download_timeout;
+	char* downloader_buf;
+};
+
+#define SOH 0x01
+#define STX 0x02
+#define EOT 0x04
+#define ACK 0x06
+#define NAK 0x15
+#define CAN 0x18
+#define CRC_MODE 'C'
+#define XMODEM_BLOCK_SIZE_1K 1024
+
+uint32_t g_flash_id = 0;
+unsigned int g_flash_size = 0;
+struct message_ack_head ACK_msg =
+{
+	.magic = ACK_MAGIC,
+	.type = 0,
+	.data_len = 0,
+	.status = STATUS_SUCCESS,
+	.CRC8 = 0
+};
+
+unsigned char cmd_data_buf[CMD_DATA_MAX_LEN] = { 0 };
+
+int uart_cmd_parser(void);
+
+#ifdef CONFIG_AMEBADPLUS
+#define SPICCLKSL BIT_LSYS_CKSL_SPIC_XTAL
+#elif CONFIG_AMEBALITE
+#define SPICCLKSL BIT_LSYS_CKSL_SPIC_LBUS
+u32 IPC_SEMTake(IPC_SEM_IDX SEM_Idx, u32 timeout)
+{
+	(void)SEM_Idx;
+	(void)timeout;
+	return true;
+}
+u32 IPC_SEMFree(IPC_SEM_IDX SEM_Idx)
+{
+	(void)SEM_Idx;
+	return true;
+}
+#endif
+
+void flasher_stub(void)
+{
+	DCache_CleanInvalidate(0xFFFFFFFF, 0xFFFFFFFF);
+	SCB_DisableDCache();
+	_memset((void*)__image1_bss_start__, 0, (__image1_bss_end__ - __image1_bss_start__));
+
+	void sburner_flash_init(void);
+	sburner_flash_init();
+	WDG_Refresh(IWDG_DEV);
+	InterruptDis(UART_LOG_IRQ);
+
+	RCC_PeriphClockSource_SPIC(SPICCLKSL);
+	FLASH_Read_HandShake_Cmd(0, DISABLE);
+	FLASH_DeepPowerDown(DISABLE);
+#ifdef CONFIG_AMEBADPLUS
+	if (flash_init_para.FLASH_addr_phase_len == ADDR_4_BYTE) {
+		FLASH_Addr4ByteEn();
+	}
+#endif
+	RCC_PeriphClockCmd(APBPeriph_SHA, APBPeriph_SHA_CLOCK, ENABLE);
+	RCC_PeriphClockCmd(APBPeriph_LX, APBPeriph_LX_CLOCK, ENABLE);
+	extern HeapRegion_t xHeapRegions[];
+	bool os_heap_add(u8 * start_addr, size_t heap_size);
+	os_heap_add((uint8_t*)0x20000000, (size_t)0xA000);
+	os_heap_add((uint8_t*)0x20050000, (size_t)0x30000);
+	vPortDefineHeapRegions(xHeapRegions);
+	vfs_init();
+	vfs_user_register(VFS_PREFIX, VFS_LITTLEFS, VFS_INF_FLASH, VFS_REGION_1, VFS_RW);
+	rt_kv_init();
+	CRYPTO_SHA_Init(NULL);
+	LOGUART_SetBaud(LOGUART_DEV, 115200);
+	while(1) uart_cmd_parser();
+}
+
+IMAGE1_ENTRY_SECTION
+RAM_FUNCTION_START_TABLE RamStartTable = {
+	.RamStartFun = flasher_stub,
+	.RamWakeupFun = flasher_stub,
+	.RamPatchFun0 = flasher_stub,
+	.RamPatchFun1 = flasher_stub,
+	.RamPatchFun2 = flasher_stub
+};
+
+//void rtk_log_write_nano(rtk_log_level_t level, const char* tag, const char letter, const char* fmt, ...) 
+//{
+//	(void)level;
+//	(void)tag;
+//	(void)letter;
+//	(void)fmt;
+//}
+
+void FLASH_EraseXIP(u32 EraseType, u32 Address)
+{
+	FLASH_Erase(EraseType, Address);
+}
+
+int FLASH_ReadStream(u32 address, u32 len, u8* pbuf)
+{
+	assert_param(pbuf != NULL);
+
+	_memcpy(pbuf, (const void*)(SPI_FLASH_BASE + address), len);
+
+	return 1;
+}
+
+int FLASH_WriteStream(u32 address, u32 len, u8* pbuf)
+{
+	/* Check address: 4byte aligned & page(256bytes) aligned */
+	u32 page_begin = address & (~0xff);
+	u32 page_end = (address + len - 1) & (~0xff);
+	u32 page_cnt = ((page_end - page_begin) >> 8) + 1;
+
+	u32 addr_begin = address;
+	u32 addr_end = (page_cnt == 1) ? (address + len) : (page_begin + 0x100);
+	u32 size = addr_end - addr_begin;
+
+	if(len == 0)
+	{
+		//RTK_LOGW(NOTAG, "function %s, data length is invalid (0) \r\n", __func__);
+		goto exit;
+	}
+
+	if(IS_FLASH_ADDR((u32)pbuf))
+	{
+		//RTK_LOGE(NOTAG, "function %s, source address(%08x) can not be flash address\r\n", __func__, pbuf);
+		//assert_param(0);
+	}
+
+	while(page_cnt)
+	{
+		FLASH_TxData(addr_begin, size, pbuf);
+		pbuf += size;
+
+		page_cnt--;
+		addr_begin = addr_end;
+		addr_end = (page_cnt == 1) ? (address + len) : (addr_begin + 0x100);
+		size = addr_end - addr_begin;
+	}
+
+	//DCache_Invalidate(SPI_FLASH_BASE + address, len);
+	//RSIP_MMU_Cache_Clean();
+
+exit:
+	return 1;
+}
+
+void uart_fifo_reset(void)
+{
+	LOGUART_ClearRxFifo(LOGUART_DEV);
+}
+void uart_putc(char ch)
+{
+#ifdef CONFIG_AMEBADPLUS
+	extern LOG_UART_PORT LOG_UART_IDX_FLAG[];
+	while(!LOGUART_Writable());
+	LOGUART_WaitTx();
+	LOGUART_DEV->LOGUART_UART_THRx[LOG_UART_IDX_FLAG[SYS_CPUID()].idx] = ch;
+	//LOGUART_WaitTxComplete();
+#else
+	LOGUART_WaitTxComplete();
+	LOGUART_DEV->LOGUART_UART_THRx[0] = ch;
+#endif
+}
+
+void uart_write(unsigned char* data, uint32_t len)
+{
+	if(!data || !len)
+	{
+		return;
+	}
+
+	for(size_t i = 0; i < len; ++i)
+	{
+		uart_putc(data[i]);
+	}
+}
+
+signed char uart_getc(uint8_t* out_byte, uint32_t timeout)
+{
+	uint64_t timeout_ticks = 0;
+	
+	if(out_byte == NULL)
+		return -1;
+	
+	while(timeout_ticks++ < timeout * 10)
+	{
+		if(timeout_ticks % 100 == 0) WDG_Refresh(IWDG_DEV);
+		u32 loguart_lsr = LOGUART_GetStatus(LOGUART_DEV);
+		if((loguart_lsr & LOGUART_BIT_DRDY))
+		//if(LOGUART_Readable())
+		//if(LOGUART_GetRxCount())
+		{
+			*out_byte = (uint8_t)LOGUART_GetChar(false);
+			return 0;
+		}
+		DelayUs(10);
+	}
+
+	return -1;    // timeout
+}
+
+void FLASH_EraseByLength(uint32_t Address, uint32_t Length)
+{
+	if((Address & 0x3) != 0)
+		return;
+	if(Length == 0)
+		return;
+
+	uint32_t cur = Address;
+	uint32_t end = Address + Length;
+
+	while(cur < end)
+	{
+		if((cur % 0x10000U == 0) && (end - cur >= 0x10000U))
+		{
+			FLASH_Erase(EraseBlock, cur);
+			cur += 0x10000U;
+		}
+		else
+		{
+			FLASH_Erase(EraseSector, cur);
+			cur += 0x1000U;
+		}
+	}
+
+	return ;
+}
+
+unsigned char uboot_mesage_check(unsigned char* buf, unsigned short length)
+{
+	unsigned int crc = 0;
+	unsigned char ret = 0;
+	unsigned int i = 0;
+
+	for(i = 0; i < length; i++)
+	{
+		crc += buf[i];
+	}
+	ret = crc % 256;
+	return ret;
+}
+
+void sburner_flash_init(void)
+{
+	FLASH_RxCmd(flash_init_para.FLASH_cmd_rd_id, 3, (uint8_t*)&g_flash_id);
+
+	unsigned char id = (g_flash_id >> 16) & 0xff;
+	switch(id)
+	{
+		case 0x15:
+			g_flash_size = 0x200000; break;
+		default:
+		case 0x16:
+			g_flash_size = 0x400000; break;
+		case 0x17:
+			g_flash_size = 0x800000; break;
+		case 0x18:
+			g_flash_size = 0x1000000; break;
+		case 0x19:
+			g_flash_size = 0x2000000; break;
+		case 0x20:
+			g_flash_size = 0x4000000; break;
+	}
+}
+
+static uint16_t crc16_ccitt(const uint8_t* data, uint16_t len)
+{
+	uint16_t crc = 0;
+	while(len--)
+	{
+		crc ^= (uint16_t)(*data++) << 8;
+		for(uint8_t i = 0; i < 8; i++)
+			crc = (crc & 0x8000) ? (crc << 1) ^ 0x1021 : (crc << 1);
+	}
+	return crc;
+}
+
+void uboot_sync(void)
+{
+	unsigned int i = 0;
+	struct message_rec_head* msg = (struct message_rec_head*)cmd_data_buf;
+
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.data_len = 0x0000;
+	ACK_msg.status = STATUS_SUCCESS;
+
+	//SYNC
+	for(i = 0; i < SYNC_REQUEST_SIZE; i++)
+	{
+		if(cmd_data_buf[HEAD_SIZE + i] != (char)((SYNC_REQUEST_VALUE >> (i * 8)) & 0xff))
+		{
+			ACK_msg.status = STATUS_ERROR;
+			ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+			uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+			return;	//eroor, again
+		}
+	}
+	ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+	uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+}
+
+void uboot_flash_erase_handle(void* buf)
+{
+	struct load_cfg_msg cfg_msg;
+	struct message_rec_head* msg = (struct message_rec_head*)buf;
+
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.data_len = 0x0000;
+	ACK_msg.status = STATUS_SUCCESS;
+
+	_memcpy(&cfg_msg, &(cmd_data_buf[HEAD_SIZE]), CFG_SIZE);
+
+	if((cfg_msg.addr + cfg_msg.len) > g_flash_size)
+	{
+		ACK_msg.status = STATUS_ADDR_ERROR;
+		ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+		uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+		return;
+	}
+
+	FLASH_EraseByLength(cfg_msg.addr, cfg_msg.len);
+	ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+	uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+}
+
+void uboot_flash_chiperase_handle(void* buf)
+{
+	struct message_rec_head* msg = (struct message_rec_head*)buf;
+
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.data_len = 0x0000;
+	ACK_msg.status = STATUS_SUCCESS;
+
+	FLASH_Erase(EraseChip, 0);
+	ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+	uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+}
+
+void uboot_buad(void)
+{
+	struct message_rec_head* msg = (struct message_rec_head*)cmd_data_buf;
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.data_len = 0x0000;
+	ACK_msg.status = STATUS_SUCCESS;
+	ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+	LOGUART_SetBaud(LOGUART_DEV, msg->run_addr);
+	DelayUs(100000);
+	uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+}
+
+void uboot_flashid(void)
+{
+	struct message_rec_head* msg = (struct message_rec_head*)cmd_data_buf;
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.status = STATUS_SUCCESS;
+	ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+	ACK_msg.data_len = 4;
+	_memcpy(cmd_data_buf, &ACK_msg, HEAD_SIZE);
+	_memcpy(&cmd_data_buf[HEAD_SIZE], &g_flash_id, 4);
+	cmd_data_buf[HEAD_SIZE + 4] = STATUS_SUCCESS;
+	cmd_data_buf[HEAD_SIZE + 4 + 1] = uboot_mesage_check((unsigned char*)cmd_data_buf, HEAD_SIZE + 4 + 1);
+	uart_write((unsigned char*)cmd_data_buf, HEAD_SIZE + 4 + 2);
+}
+
+void uboot_flash_xmodem_dl(void* buf)
+{
+	uint8_t header[3] = { 0x00 };
+	uint8_t data[XMODEM_BLOCK_SIZE_1K] = { 0x00 };
+	uint8_t crc_bytes[2] = { 0x00 };
+	uint16_t crc_calc, crc_recv;
+	uint32_t offset = 0;
+	struct load_cfg_msg cfg_msg;
+	struct message_rec_head* msg = (struct message_rec_head*)buf;
+	ACK_msg.status = STATUS_SUCCESS;
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.data_len = 0x0000;
+	ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+
+	_memcpy(&cfg_msg, &(cmd_data_buf[HEAD_SIZE]), CFG_SIZE);
+
+	if((cfg_msg.addr + cfg_msg.len) > g_flash_size)
+	{
+		ACK_msg.status = STATUS_ADDR_ERROR;
+		ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+		uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+		return;
+	}
+
+	uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+
+	FLASH_EraseByLength(cfg_msg.addr, cfg_msg.len);
+
+	uart_putc(CRC_MODE);
+
+	for(;;)
+	{
+		// header
+		if(uart_getc(&header[0], 1000) != 0)
+		{
+			uart_putc(CRC_MODE);
+			continue;
+		}
+
+		if(header[0] == EOT)
+		{
+			uart_putc(ACK);
+			break;
+		}
+
+#define NAKCONTINUE { uart_putc(NAK); continue; }
+
+		if(header[0] != STX) NAKCONTINUE
+
+		if(uart_getc(&header[1], 2000) == -1) NAKCONTINUE
+		if(uart_getc(&header[2], 2000) == -1) NAKCONTINUE
+
+		if((header[1] + header[2]) != 0xFF) NAKCONTINUE
+
+		// recv data + crc
+		for(int i = 0; i < XMODEM_BLOCK_SIZE_1K; i++)
+			if(uart_getc(&data[i], 2000) == -1) NAKCONTINUE
+		if(uart_getc(&crc_bytes[0], 2000) == -1) NAKCONTINUE
+		if(uart_getc(&crc_bytes[1], 2000) == -1) NAKCONTINUE
+
+		crc_recv = ((uint16_t)crc_bytes[0] << 8) | crc_bytes[1];
+		crc_calc = crc16_ccitt(data, XMODEM_BLOCK_SIZE_1K);
+
+		if(crc_recv != crc_calc) NAKCONTINUE
+
+		FLASH_WriteStream(cfg_msg.addr + offset, XMODEM_BLOCK_SIZE_1K, data);
+		offset += XMODEM_BLOCK_SIZE_1K;
+
+		uart_putc(ACK);
+	}
+	//LOGUART_SetBaud(LOGUART_DEV, 115200);
+}
+
+void uboot_flash_xmodem_ul(void* buf)
+{
+	uint8_t block_num = 1;
+	uint8_t data[XMODEM_BLOCK_SIZE_1K];
+	uint8_t resp = 0;
+	uint32_t offset = 0;
+	int retry, ret;
+	struct load_cfg_msg cfg_msg;
+	struct message_rec_head* msg = (struct message_rec_head*)buf;
+	ACK_msg.status = STATUS_SUCCESS;
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.data_len = 0x0000;
+	ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+
+	_memcpy(&cfg_msg, &(cmd_data_buf[HEAD_SIZE]), CFG_SIZE);
+	uint32_t data_len = cfg_msg.len;
+
+	uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+
+	// wait for 'C'
+	do
+	{
+		if(uart_getc(&resp, 1000) != 0)
+			continue;
+	} while(resp != CRC_MODE);
+
+	while(data_len > 0)
+	{
+		uint32_t chunk = (data_len > XMODEM_BLOCK_SIZE_1K) ? XMODEM_BLOCK_SIZE_1K : data_len;
+		memset(data, 0xFF, XMODEM_BLOCK_SIZE_1K); // pad with 0xFF
+
+		FLASH_ReadStream(cfg_msg.addr + offset, chunk, data);
+
+		uint16_t crc = crc16_ccitt(data, XMODEM_BLOCK_SIZE_1K);
+
+		retry = 0;
+		do
+		{
+			uart_putc(STX);
+			uart_putc(block_num);
+			uart_putc(~block_num);
+
+			for(uint16_t i = 0; i < XMODEM_BLOCK_SIZE_1K; i++)
+				uart_putc(data[i]);
+
+			uart_putc((crc >> 8) & 0xFF);
+			uart_putc(crc & 0xFF);
+
+			ret = uart_getc(&resp, 5000);
+			if(ret == 0 && resp == ACK)
+				break;
+
+			retry++;
+		} while(retry < 50);
+
+		if(retry >= 50)
+		{
+			uart_putc(CAN);
+			uart_putc(CAN);
+			return;
+		}
+
+		offset += chunk;
+		data_len -= chunk;
+		block_num++;
+	}
+
+	retry = 0;
+	do
+	{
+		uart_putc(EOT);
+
+		ret = uart_getc(&resp, 5000);
+
+		if(ret == 0 && resp == ACK)
+			break;
+
+		retry++;
+	} while(retry < 10);
+
+	if(retry >= 10)
+	{
+		uart_putc(CAN);
+		uart_putc(CAN);
+	}
+
+	return;
+}
+
+void uboot_flash_sha256(void* buf)
+{
+	struct load_cfg_msg cfg_msg;
+	struct message_rec_head* msg = (struct message_rec_head*)buf;
+
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.data_len = 32;
+
+	_memcpy(&cfg_msg, &(cmd_data_buf[HEAD_SIZE]), CFG_SIZE);
+
+	if((cfg_msg.addr + cfg_msg.len) > g_flash_size)
+	{
+		ACK_msg.data_len = 0;
+		ACK_msg.status = STATUS_ADDR_ERROR;
+		ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+		uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+		return;
+	}
+	ALIGNMTO(CACHE_LINE_SIZE) u8 hash[32] = { 0 };
+	hw_sha_context  ctx = { 0 };
+	rtl_crypto_sha2_init(SHA2_256 , &ctx);
+	uint32_t addr = cfg_msg.addr;
+	uint32_t remaining = cfg_msg.len;
+	while(remaining > 0)
+	{
+		uint32_t chunk = remaining > 0x40000 ? 0x40000 : remaining;
+		WDG_Refresh(IWDG_DEV);
+		rtl_crypto_sha2_update((uint8_t*)(SPI_FLASH_BASE + addr), chunk, &ctx);
+		addr += chunk;
+		remaining -= chunk;
+	}
+	
+	rtl_crypto_sha2_final(hash, &ctx);
+
+	_memcpy(cmd_data_buf, &ACK_msg, HEAD_SIZE);
+	_memcpy(&cmd_data_buf[HEAD_SIZE], &hash, 32);
+	cmd_data_buf[HEAD_SIZE + 32] = STATUS_SUCCESS;
+	cmd_data_buf[HEAD_SIZE + 32 + 1] = uboot_mesage_check((unsigned char*)cmd_data_buf, HEAD_SIZE + 32 + 1);
+	uart_write((unsigned char*)cmd_data_buf, HEAD_SIZE + 32 + 2);
+}
+
+void uboot_kv_get(void* buf)
+{
+	struct message_rec_head* msg = (struct message_rec_head*)buf;
+	char kvname[MAX_KEY_LENGTH] = { 0 };
+	strncpy((char*)&kvname, (const char*)&(cmd_data_buf[HEAD_SIZE]), msg->data_len);
+	int kvsize = rt_kv_size(kvname);
+
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.data_len = kvsize;
+
+	if(kvsize <= 0)
+	{
+		ACK_msg.data_len = 0;
+		ACK_msg.status = STATUS_ERROR;
+		ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+		uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+		return;
+	}
+
+	_memcpy(cmd_data_buf, &ACK_msg, HEAD_SIZE);
+	rt_kv_get(kvname, &cmd_data_buf[HEAD_SIZE], kvsize);
+	cmd_data_buf[HEAD_SIZE + kvsize] = STATUS_SUCCESS;
+	cmd_data_buf[HEAD_SIZE + kvsize + 1] = uboot_mesage_check((unsigned char*)cmd_data_buf, HEAD_SIZE + kvsize + 1);
+	uart_write((unsigned char*)cmd_data_buf, HEAD_SIZE + kvsize + 2);
+}
+
+void uboot_kv_set(void* buf)
+{
+	uint8_t header[3] = { 0x00 };
+	uint8_t data[XMODEM_BLOCK_SIZE_1K] = { 0x00 };
+	uint8_t crc_bytes[2] = { 0x00 };
+	uint16_t crc_calc, crc_recv;
+	uint32_t offset = 0;
+	struct message_rec_head* msg = (struct message_rec_head*)buf;
+	char kvname[16] = { 0 };
+	unsigned char namelen = cmd_data_buf[HEAD_SIZE];
+	strncpy((char*)&kvname, (const char*)&(cmd_data_buf[HEAD_SIZE + 3]), namelen);
+	uint16_t datasize = cmd_data_buf[HEAD_SIZE + 1] | cmd_data_buf[HEAD_SIZE + 2] << 8;
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.data_len = 0;
+	ACK_msg.status = STATUS_SUCCESS;
+	ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+
+	uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+
+	for(;;)
+	{
+		// header
+		if(uart_getc(&header[0], 1000) != 0)
+		{
+			uart_putc(CRC_MODE);
+			continue;
+		}
+
+		if(header[0] == EOT)
+		{
+			uart_putc(ACK);
+			break;
+		}
+
+#define NAKCONTINUE { uart_putc(NAK); continue; }
+
+		if(header[0] != STX) NAKCONTINUE
+
+		if(uart_getc(&header[1], 2000) == -1) NAKCONTINUE
+		if(uart_getc(&header[2], 2000) == -1) NAKCONTINUE
+
+		if((header[1] + header[2]) != 0xFF) NAKCONTINUE
+
+		// recv data + crc
+		for(int i = 0; i < XMODEM_BLOCK_SIZE_1K; i++)
+			if(uart_getc(&data[i], 2000) == -1) NAKCONTINUE
+		if(uart_getc(&crc_bytes[0], 2000) == -1) NAKCONTINUE
+		if(uart_getc(&crc_bytes[1], 2000) == -1) NAKCONTINUE
+
+		crc_recv = ((uint16_t)crc_bytes[0] << 8) | crc_bytes[1];
+		crc_calc = crc16_ccitt(data, XMODEM_BLOCK_SIZE_1K);
+
+		if(crc_recv != crc_calc) NAKCONTINUE
+
+		_memcpy(cmd_data_buf + offset, data, XMODEM_BLOCK_SIZE_1K);
+		offset += XMODEM_BLOCK_SIZE_1K;
+
+		uart_putc(ACK);
+	}
+	rt_kv_set(kvname, &cmd_data_buf, datasize);
+}
+
+void uboot_get_mac(void)
+{
+	struct message_rec_head* msg = (struct message_rec_head*)cmd_data_buf;
+	ACK_msg.magic = ACK_MAGIC;
+	ACK_msg.type = msg->type;
+	ACK_msg.status = STATUS_SUCCESS;
+	ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+	ACK_msg.data_len = 6;
+	_memcpy(cmd_data_buf, &ACK_msg, HEAD_SIZE);
+	OTP_LogicalMap_Read(&cmd_data_buf[HEAD_SIZE], 0x11A, 6);
+	cmd_data_buf[HEAD_SIZE + 6] = STATUS_SUCCESS;
+	cmd_data_buf[HEAD_SIZE + 6 + 1] = uboot_mesage_check((unsigned char*)cmd_data_buf, HEAD_SIZE + 6 + 1);
+	uart_write((unsigned char*)cmd_data_buf, HEAD_SIZE + 6 + 2);
+}
+
+int uart_cmd_parser(void)
+{
+	unsigned int i = 0;
+	signed char resp = 0;
+	unsigned char CRC8 = 0;
+	unsigned char buf[HEAD_SIZE] = { 0 };
+	struct message_rec_head rec_head;
+
+	unsigned char cfgbuf[CFG_SIZE] = { 0 };
+
+	uart_fifo_reset();
+
+	do
+	{
+		memset(buf, 0, HEAD_SIZE);
+		for(i = 0; i < HEAD_SIZE; ++i)
+		{
+			resp = uart_getc((unsigned char*)&buf[i], 0xFFFFFFFF);
+			if(resp < 0)
+			{
+				resp = MSG_ERR;
+				return resp;
+			}
+			if((buf[0]) != MAGIC)
+			{
+				i = 0xFFFFFFFF;
+			}
+		}
+
+		_memcpy(cmd_data_buf, buf, HEAD_SIZE);
+		_memcpy(&rec_head, buf, HEAD_SIZE);
+
+		if(buf[1] <= 0x9F)
+		{
+			for(i = 0; i < rec_head.data_len; i++)
+			{
+				resp = uart_getc((unsigned char*)&cfgbuf[i], 0xFFFFFFFF);
+				if(resp < 0)
+				{
+					resp = MSG_ERR;
+					return resp;
+				}
+			}
+			_memcpy(&(cmd_data_buf[HEAD_SIZE]), cfgbuf, rec_head.data_len);
+
+			resp = uart_getc((unsigned char*)&cmd_data_buf[HEAD_SIZE + rec_head.data_len], 0xFFFFFFFF);
+			if(resp < 0)
+			{
+				resp = MSG_ERR;
+				return resp;
+			}
+			CRC8 = uboot_mesage_check((unsigned char*)cmd_data_buf, HEAD_SIZE + rec_head.data_len);
+			if(cmd_data_buf[HEAD_SIZE + rec_head.data_len] != CRC8)
+			{
+				rec_head.type = STATE_ERR;
+			}
+		}
+		else
+		{
+			rec_head.type = STATE_ERR;
+		}
+
+
+		switch(rec_head.type)
+		{
+			case STATE_SYN:
+				uboot_sync();
+				break;
+			case STATE_FLASH_ERASE: // 0x04
+				uboot_flash_erase_handle(&cmd_data_buf);
+				break;
+			case STATE_FLASH_CHIPERASE: // 0x05
+				uboot_flash_chiperase_handle(&cmd_data_buf);
+				break;
+			case STATE_BOUND: // 0x07
+				uboot_buad();
+				break;
+			case 0x09:
+				uboot_flash_sha256(&cmd_data_buf);
+				break;
+			case 0x90:
+				uboot_flashid();
+				break;
+			case 0x91:
+				uboot_flash_xmodem_dl(&cmd_data_buf);
+				break;
+			case 0x92:
+				uboot_flash_xmodem_ul(&cmd_data_buf);
+				break;
+			case 0x93:
+				uboot_kv_get(&cmd_data_buf);
+				break;
+			case 0x94:
+				uboot_kv_set(&cmd_data_buf);
+				break;
+			case 0x95:
+				uboot_get_mac();
+				break;
+
+			default:
+				ACK_msg.type = STATE_ERR;
+				ACK_msg.status = STATUS_TYPE_ERROR;
+				ACK_msg.CRC8 = uboot_mesage_check((unsigned char*)&ACK_msg, ACK_SIZE - 1);
+				uart_write((unsigned char*)&ACK_msg, ACK_SIZE);
+				break;
+		}
+	} while(1);
+}
--- a/platforms/RTL8721DA/flasher_stub/stub.ld
+++ b/platforms/RTL8721DA/flasher_stub/stub.ld
@ -0,0 +1,103 @@
+ENTRY(Reset_Handler)
+
+#include "ameba_layout.ld"
+#include "project_km4/platform_autoconf.h"
+
+MEMORY
+{
+    EXTENDED_FLOADER_RAM (rwx) : ORIGIN = 0x3000A020, LENGTH = 0x30040000 - 0x3000A020
+}
+
+/* define common load memory address */
+#ifdef  GENERATE_FLOADER_LD
+	#define OUTSECTION ram_image1
+	#define IMG1_LMA_REGION 	EXTENDED_FLOADER_RAM
+	#define KM4_LOADER_LMA	 	EXTENDED_FLOADER_RAM
+#else
+	#define KM4_LOADER_LMA  	KM4_BOOTLOADER_RAM_S
+	#ifdef CONFIG_IMG1_FLASH
+		#define OUTSECTION xip_image1
+		#define IMG1_LMA_REGION KM4_BOOT_XIP
+	#else
+		#define OUTSECTION ram_image1
+		#define IMG1_LMA_REGION KM4_BOOTLOADER_RAM_S
+	#endif
+#endif
+
+/* define trustzone load memory address */
+#ifdef CONFIG_IMG3_SRAM
+	#define LMA_TZ_REGION KM4_BD_RAM_TZ_S
+#else
+	#define LMA_TZ_REGION KM4_BD_PSRAM_TZ_S
+#endif
+
+
+SECTIONS
+{
+	/* image1: boot image start */
+	/* image1 entry, this section should in RAM and fixed address for ROM */
+	.ram_image1.entry :
+	{
+		__ram_image1_text_start__ = .;
+		__ram_start_table_start__ = .;
+		KEEP(*(SORT(.image1.entry.data*)))
+		KEEP(*(.image1.validate.rodata*))
+		*(.image1.export.symb)
+	} > KM4_LOADER_LMA
+
+	/*  Add . to assign the start address of the section */
+	/*  to prevent the change of the start address by ld doing section alignment */
+	.ram_image1.text :
+	{
+		/* image1 text */
+		/* If there is any code that must be placed in RAM, please use .sramdram.only.text section*/
+		*(.sramdram.only.text*)
+		. = ALIGN (32);
+	} > KM4_LOADER_LMA
+
+	.OUTSECTION.text :
+	{
+		/* image1 text */
+		*(.text*)
+		*(.non.dram.text*)
+		*(.rodata*)
+		. = ALIGN (32);
+	} > IMG1_LMA_REGION
+
+	.ram_image1.data :
+	{
+		__ram_image1_data_start__ = .;
+		*(.data*)
+		. = ALIGN(32);
+		__ram_image1_data_end__ = .;
+
+		__ram_image1_text_end__ = .;
+	} > KM4_LOADER_LMA
+
+	.ram_image1.bss :
+	{
+		__image1_bss_start__ = .;
+		*(.bss*)
+		__image1_bss_end__ = .;
+	} > KM4_LOADER_LMA
+
+	/* image2: normal image start */
+/*
+	.ram_image2.entry :
+	{
+		__ram_image2_text_start__ = .;
+		__image2_entry_func__ = .;
+		KEEP(*(SORT(.image2.entry.data*)))
+	} > KM4_IMG2_ENTRY
+*/
+	/* TFM text*/
+/*
+	.ram_image3.text :
+	{
+		__ram_image3_start__ = .;
+		__ram_image3_end__ = __ram_image3_start__ + LENGTH(LMA_TZ_REGION);
+	} > LMA_TZ_REGION
+*/
+}
+
+__rom_stdlib_text_start__ = ORIGIN(KM4_IROM_STDLIB_NS);