diff --git a/CHANGELOG b/CHANGELOG
index 4a5e561..3a9d22a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -2,6 +2,14 @@
 Changes for U-Boot 1.0.0:
 ======================================================================
 
+* Make fatload set filesize environment variable
+
+* enable basic / medium / high-end configurations for PPChameleonEVB
+  board; fix NAND code
+
+* enable TFTP client code to specify to the server the desired
+  timeout value (see RFC-2349)
+
 * Improve SDRAM setup for TRAB board
 
 * Suppress all output with splashscreen configured only if "splashimage"
diff --git a/Makefile b/Makefile
index 1719cc5..80dc424 100644
--- a/Makefile
+++ b/Makefile
@@ -478,6 +478,7 @@
 #########################################################################
 ## PPC4xx Systems
 #########################################################################
+xtract_4xx = $(subst _MODEL_BA,,$(subst _MODEL_ME,,$(subst _MODEL_HI,,$(subst _config,,$1))))
 
 ADCIOP_config:	unconfig
 	@./mkconfig $(@:_config=) ppc ppc4xx adciop esd
@@ -557,8 +558,24 @@
 PMC405_config:	unconfig
 	@./mkconfig $(@:_config=) ppc ppc4xx pmc405 esd
 
+PPChameleonEVB_MODEL_BA_config	\
+PPChameleonEVB_MODEL_ME_config	\
+PPChameleonEVB_MODEL_HI_config	\
 PPChameleonEVB_config:	unconfig
-	@./mkconfig $(@:_config=) ppc ppc4xx PPChameleonEVB dave
+	@ >include/config.h
+	@[ -z "$(findstring _MODEL_BA,$@)" ] || \
+		{ echo "#define CONFIG_PPCHAMELEON_MODULE_MODEL 0" >>include/config.h ; \
+		  echo "... BASIC model" ; \
+		}
+	@[ -z "$(findstring _MODEL_ME,$@)" ] || \
+		{ echo "#define CONFIG_PPCHAMELEON_MODULE_MODEL 1" >>include/config.h ; \
+		  echo "... MEDIUM model" ; \
+		}
+	@[ -z "$(findstring _MODEL_HI,$@)" ] || \
+		{ echo "#define CONFIG_PPCHAMELEON_MODULE_MODEL 2" >>include/config.h ; \
+		  echo "... HIGH-END model" ; \
+		}
+	@./mkconfig -a $(call xtract_4xx,$@) ppc ppc4xx PPChameleonEVB dave
 
 VOH405_config:	unconfig
 	@./mkconfig $(@:_config=) ppc ppc4xx voh405 esd
diff --git a/board/dave/PPChameleonEVB/PPChameleonEVB.c b/board/dave/PPChameleonEVB/PPChameleonEVB.c
index 47670fa..811f6f8 100644
--- a/board/dave/PPChameleonEVB/PPChameleonEVB.c
+++ b/board/dave/PPChameleonEVB/PPChameleonEVB.c
@@ -261,10 +261,13 @@
 void
 nand_init(void)
 {
-	ulong totlen;
+	ulong totlen = 0;
 
+#if (CONFIG_PPCHAMELEON_MODULE_MODEL == CONFIG_PPCHAMELEON_MODULE_ME) || \
+    (CONFIG_PPCHAMELEON_MODULE_MODEL == CONFIG_PPCHAMELEON_MODULE_HI)
 	debug ("Probing at 0x%.8x\n", CFG_NAND0_BASE);
-	totlen = nand_probe (CFG_NAND0_BASE);
+	totlen += nand_probe (CFG_NAND0_BASE);
+#endif	/* CONFIG_PPCHAMELEON_MODULE_ME, CONFIG_PPCHAMELEON_MODULE_HI */
 
 	debug ("Probing at 0x%.8x\n", CFG_NAND1_BASE);
 	totlen += nand_probe (CFG_NAND1_BASE);
diff --git a/board/trab/auto_update.c b/board/trab/auto_update.c
index c9c61ea..3113cf8 100644
--- a/board/trab/auto_update.c
+++ b/board/trab/auto_update.c
@@ -313,9 +313,12 @@
 
 	/* execute a script */
 	if (hdr->ih_type == IH_TYPE_SCRIPT) {
-		addr = (char *)((char *)hdr + sizeof(*hdr) + 8);
-		parse_string_outer(addr,
-			FLAG_PARSE_SEMICOLON | FLAG_EXIT_FROM_LOOP);
+		addr = (char *)((char *)hdr + sizeof(*hdr));
+		/* stick a NULL at the end of the script, otherwise */
+		/* parse_string_outer() runs off the end. */
+		addr[ntohl(hdr->ih_size)] = 0;
+		addr += 8;
+		parse_string_outer(addr, FLAG_PARSE_SEMICOLON);
 		return 0;
 	}
 
@@ -333,8 +336,7 @@
 #endif
 		debug ("protect off %lx %lx\n", start, end);
 		sprintf(strbuf, "protect off %lx %lx\n", start, end);
-		parse_string_outer(strbuf,
-			FLAG_PARSE_SEMICOLON | FLAG_EXIT_FROM_LOOP);
+		parse_string_outer(strbuf, FLAG_PARSE_SEMICOLON);
 	}
 
 	/*
@@ -344,12 +346,11 @@
 	if (repeat == 0) {
 		debug ("erase %lx %lx\n", start, end);
 		sprintf(strbuf, "erase %lx %lx\n", start, end);
-		parse_string_outer(strbuf,
-			FLAG_PARSE_SEMICOLON | FLAG_EXIT_FROM_LOOP);
+		parse_string_outer(strbuf, FLAG_PARSE_SEMICOLON);
 	}
 	wait_ms(100);
-	/* strip the header - except for the kernel */
-	if (idx == IDX_FIRMWARE || idx == IDX_DISK || idx == IDX_APP) {
+	/* strip the header - except for the kernel and app */
+	if (idx == IDX_FIRMWARE || idx == IDX_DISK) {
 		addr = (char *)((char *)hdr + sizeof(*hdr));
 #ifdef AU_UPDATE_TEST
 		/* copy it to where Linux goes */
@@ -367,8 +368,7 @@
 	/* copy the data from RAM to FLASH */
 	debug ("cp.b %p %lx %x\n", addr, start, nbytes);
 	sprintf(strbuf, "cp.b %p %lx %x\n", addr, start, nbytes);
-	parse_string_outer(strbuf,
-		FLAG_PARSE_SEMICOLON | FLAG_EXIT_FROM_LOOP);
+	parse_string_outer(strbuf, FLAG_PARSE_SEMICOLON);
 
 	/* check the dcrc of the copy */
 	if (crc32 (0, (char *)(start + off), ntohl(hdr->ih_size)) != ntohl(hdr->ih_dcrc)) {
@@ -381,8 +381,7 @@
 	if (idx == IDX_FIRMWARE) {
 		debug ("protect on %lx %lx\n", start, end);
 		sprintf(strbuf, "protect on %lx %lx\n", start, end);
-		parse_string_outer(strbuf,
-			FLAG_PARSE_SEMICOLON | FLAG_EXIT_FROM_LOOP);
+		parse_string_outer(strbuf, FLAG_PARSE_SEMICOLON);
 	}
 	return 0;
 }
@@ -493,8 +492,11 @@
 	env = getenv("firmware_nd");
 	if (env != NULL)
 		end = simple_strtoul(env, NULL, 16);
-	if (start >= 0 && end && end > start)
+	if (start >= 0 && end && end > start) {
 		ausize[IDX_FIRMWARE] = (end + 1) - start;
+		aufl_layout[0].start = start;
+		aufl_layout[0].end = end;
+	}
 	start = -1;
 	end = 0;
 	env = getenv("kernel_st");
@@ -503,8 +505,11 @@
 	env = getenv("kernel_nd");
 	if (env != NULL)
 		end = simple_strtoul(env, NULL, 16);
-	if (start >= 0 && end && end > start)
+	if (start >= 0 && end && end > start) {
 		ausize[IDX_KERNEL] = (end + 1) - start;
+		aufl_layout[1].start = start;
+		aufl_layout[1].end = end;
+	}
 	start = -1;
 	end = 0;
 	env = getenv("app_st");
@@ -513,8 +518,11 @@
 	env = getenv("app_nd");
 	if (env != NULL)
 		end = simple_strtoul(env, NULL, 16);
-	if (start >= 0 && end && end > start)
+	if (start >= 0 && end && end > start) {
 		ausize[IDX_APP] = (end + 1) - start;
+		aufl_layout[2].start = start;
+		aufl_layout[2].end = end;
+	}
 	start = -1;
 	end = 0;
 	env = getenv("disk_st");
@@ -523,8 +531,11 @@
 	env = getenv("disk_nd");
 	if (env != NULL)
 		end = simple_strtoul(env, NULL, 16);
-	if (start >= 0 && end && end > start)
+	if (start >= 0 && end && end > start) {
 		ausize[IDX_DISK] = (end + 1) - start;
+		aufl_layout[3].start = start;
+		aufl_layout[3].end = end;
+	}
 	/* make sure that we see CTRL-C and save the old state */
 	old_ctrlc = disable_ctrlc(0);
 
diff --git a/common/cmd_fat.c b/common/cmd_fat.c
index 2a1da95..c5b3f06 100644
--- a/common/cmd_fat.c
+++ b/common/cmd_fat.c
@@ -74,6 +74,7 @@
 	long size;
 	unsigned long offset;
 	unsigned long count;
+	char buf [12];
 	block_dev_desc_t *dev_desc=NULL;
 	int dev=0;
 	int part=1;
@@ -107,11 +108,15 @@
 		count = 0;
 	size = file_fat_read (argv[4], (unsigned char *) offset, count);
 
-	if(size==-1)
+	if(size==-1) {
 		printf("\n** Unable to read \"%s\" from %s %d:%d **\n",argv[4],argv[1],dev,part);
-	else
+	} else {
 		printf ("\n%ld bytes read\n", size);
 
+		sprintf(buf, "%lX", size);
+		setenv("filesize", buf);
+	}
+
 	return size;
 }
 
diff --git a/common/cmd_fdos.c b/common/cmd_fdos.c
index adaddcd..dc02b35 100644
--- a/common/cmd_fdos.c
+++ b/common/cmd_fdos.c
@@ -43,7 +43,7 @@
     char *ep;
     int size;
     int rcode = 0;
-    char buf [10];
+    char buf [12];
     int drive = CFG_FDC_DRIVE_NUMBER;
 
     /* pre-set load_addr */
diff --git a/include/configs/PPChameleonEVB.h b/include/configs/PPChameleonEVB.h
index 7c7b98c..1630bc3 100644
--- a/include/configs/PPChameleonEVB.h
+++ b/include/configs/PPChameleonEVB.h
@@ -1,9 +1,12 @@
 /*
- * (C) Copyright 2001-2003
- * Stefan Roese, esd gmbh germany, stefan.roese@esd-electronics.com
+ * (C) Copyright 2003
+ * DAVE Srl
  *
- * See file CREDITS for list of people who contributed to this
- * project.
+ * http://www.dave-tech.it
+ * http://www.wawnet.biz
+ * mailto:info@wawnet.biz
+ *
+ * Credits: Stefan Roese, Wolfgang Denk
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
@@ -28,6 +31,13 @@
 #ifndef __CONFIG_H
 #define __CONFIG_H
 
+#define CONFIG_PPCHAMELEON_MODULE_BA	0	/* Basic    Model */	
+#define CONFIG_PPCHAMELEON_MODULE_ME	1	/* Medium   Model */
+#define CONFIG_PPCHAMELEON_MODULE_HI	2	/* High-End Model */
+#ifndef	CONFIG_PPCHAMELEON_MODULE_MODEL
+#define	CONFIG_PPCHAMELEON_MODULE_MODEL	CONFIG_PPCHAMELEON_MODULE_BA
+#endif
+
 /*
  * Debug stuff
  */
@@ -150,6 +160,7 @@
 
 #define CFG_MAX_NAND_DEVICE	2	/* Max number of NAND devices		*/
 #define SECTORSIZE 512
+#define NAND_NO_RB
 
 #define ADDR_COLUMN 1
 #define ADDR_PAGE 2
@@ -248,19 +259,15 @@
         } \
 } while(0)
 
+#ifdef NAND_NO_RB
+/* constant delay (see also tR in the datasheet) */
 #define NAND_WAIT_READY(nand) do { \
-	ulong mask = 0; \
-	switch ((ulong)(((struct nand_chip *)nand)->IO_ADDR)) { \
-	case CFG_NAND0_BASE: \
-		mask = CFG_NAND0_RDY; \
-		break; \
-	case CFG_NAND1_BASE: \
-		mask = CFG_NAND1_RDY; \
-		break; \
-	} \
-	while (!(in32(GPIO0_IR) & mask)) \
-		; \
+	udelay(12); \
 } while (0)
+#else
+/* use the R/B pin */
+/* TBD */
+#endif
 
 #define WRITE_NAND_COMMAND(d, adr) do{ *(volatile __u8 *)((unsigned long)adr) = (__u8)(d); } while(0)
 #define WRITE_NAND_ADDRESS(d, adr) do{ *(volatile __u8 *)((unsigned long)adr) = (__u8)(d); } while(0)
diff --git a/include/image.h b/include/image.h
index b93d104..9c6f95b 100644
--- a/include/image.h
+++ b/include/image.h
@@ -112,6 +112,7 @@
 #define IH_TYPE_MULTI		4	/* Multi-File Image		*/
 #define IH_TYPE_FIRMWARE	5	/* Firmware Image		*/
 #define IH_TYPE_SCRIPT		6	/* Script file			*/
+#define IH_TYPE_FILESYSTEM	7	/* Filesystem Image (any type)	*/
 
 /*
  * Compression Types
diff --git a/net/tftp.c b/net/tftp.c
index 1154cb9..049df68 100644
--- a/net/tftp.c
+++ b/net/tftp.c
@@ -15,7 +15,7 @@
 #if (CONFIG_COMMANDS & CFG_CMD_NET)
 
 #define WELL_KNOWN_PORT	69		/* Well known TFTP port #		*/
-#define TIMEOUT		2		/* Seconds to timeout for a lost pkt	*/
+#define TIMEOUT		5		/* Seconds to timeout for a lost pkt	*/
 #ifndef	CONFIG_NET_RETRY_COUNT
 # define TIMEOUT_COUNT	10		/* # of timeouts before giving up  */
 #else
@@ -32,6 +32,7 @@
 #define TFTP_DATA	3
 #define TFTP_ACK	4
 #define TFTP_ERROR	5
+#define TFTP_OACK	6
 
 
 static int	TftpServerPort;		/* The UDP port at their end		*/
@@ -44,6 +45,7 @@
 #define STATE_DATA	2
 #define STATE_TOO_LARGE	3
 #define STATE_BAD_MAGIC	4
+#define STATE_OACK	5
 
 #define DEFAULT_NAME_LEN	(8 + 4 + 1)
 static char default_filename[DEFAULT_NAME_LEN];
@@ -113,10 +115,18 @@
 		pkt += strlen(tftp_filename) + 1;
 		strcpy ((char *)pkt, "octet");
 		pkt += 5 /*strlen("octet")*/ + 1;
+		strcpy ((char *)pkt, "timeout");
+		pkt += 7 /*strlen("timeout")*/ + 1;
+		sprintf((char *)pkt, "%d", TIMEOUT);
+#ifdef ET_DEBUG
+		printf("send option \"timeout %s\"\n", (char *)pkt);
+#endif
+		pkt += strlen((char *)pkt) + 1;
 		len = pkt - xp;
 		break;
 
 	case STATE_DATA:
+	case STATE_OACK:
 		xp = pkt;
 		*((ushort *)pkt)++ = htons(TFTP_ACK);
 		*((ushort *)pkt)++ = htons(TftpBlock);
@@ -173,6 +183,14 @@
 	default:
 		break;
 
+	case TFTP_OACK:
+#ifdef ET_DEBUG
+		printf("Got OACK: %s %s\n", pkt, pkt+strlen(pkt)+1);
+#endif
+		TftpState = STATE_OACK;
+		TftpServerPort = src;
+		TftpSend (); /* Send ACK */
+		break;
 	case TFTP_DATA:
 		if (len < 2)
 			return;
@@ -184,7 +202,13 @@
 			puts ("\n\t ");
 		}
 
+#ifdef ET_DEBUG
 		if (TftpState == STATE_RRQ) {
+			printf("Server did not acknowledge timeout option!\n");
+		}
+#endif
+
+		if (TftpState == STATE_RRQ || TftpState == STATE_OACK) {
 			TftpState = STATE_DATA;
 			TftpServerPort = src;
 			TftpLastBlock = 0;
@@ -305,6 +329,7 @@
 	TftpTimeoutCount = 0;
 	TftpState = STATE_RRQ;
 	TftpOurPort = 1024 + (get_timer(0) % 3072);
+	TftpBlock = 0;
 
 	/* zero out server ether in case the server ip has changed */
 	memset(NetServerEther, 0, 6);