2 Installation of RedBoot on a Target Board using RedBoot's Flash Commands
3 ------------------------------------------------------------------------
5 These are generic instructions applicable to RedBoot for many platforms.
6 Details of what you type have been changed to refer specifically to the
7 nanoEngine hardware, but you should also read the further instructions for
8 Bright Star Engineering's nanoEngine and SA1110 boards - known as target
9 "nano" in eCos configuration terms - which follow.
11 Here's how to install RedBoot, using the redboot images you should find in
13 in your installation directory (sizes and dates are just examples):
14 431497 Aug 9 15:28 redboot-ram.elf
15 184802 Aug 9 15:28 redboot-ram.srec
16 433104 Aug 9 15:29 redboot-rom.elf (not used in this recipe)
17 194732 Aug 9 15:29 redboot-rom.srec
19 Copy the two '.srec' files to /tftpboot or where-ever they have to be for
22 Briefly, we use whatever boot flash image you have in place already (CygMon
23 or an eCos stub ROM) along with GDB, to execute a RAM based version of
24 RedBoot. That is used, in its command-line mode, to fetch a ROM-based boot
25 image of RedBoot and write it into the flash memory. "Fetching" the image
26 means TFTP from a server; the image must be in S-Record format. We then
27 reset the target, thus running the newly-installed boot image of RedBoot.
28 That in turn is used, in its command-line mode, to fetch a RAM-based boot
29 image of RedBoot and write it into a different area of the flash memory, in
30 order to make it easier to do the first part (running a RAM-based RedBoot
31 in order to update the boot block) again in future.
33 NB: the instructions below refer to a system with 8Mb of flash, at address
34 0x50000000 in memory. That address is common to SA11x0 CPUs.
36 Other boards might have a different start address, such as 0x41000000 and
37 different flash blocksizes. RedBoot's startup banner will tell you the
38 details, if all is functioning correctly. If the address is different, you
39 must use different addresses for saving the images into the Flash Image
40 System (fis). The command "fis list" will tell you the addresses to use
41 for the "RedBoot" and "RedBoot[backup]" images, immediately after the "fis
45 Alternatively you can make a plain binary from the redboot-rom.elf and
46 "blow" that into the boot flash using the means of your choice, as with
50 1. Load a RedBoot, built for RAM startup, into RAM using existing GDB
51 stubs. Note: do not run it yet!
53 % arm-elf-gdb -nw loaders/nano/redboot-ram.elf
55 GNU gdb 4.18-ecos-99r1-991015
56 Copyright 1998 Free Software Foundation, Inc.
57 GDB is free software, covered by the GNU General Public License, and you are
58 welcome to change it and/or distribute copies of it under certain conditions.
59 Type "show copying" to see the conditions. This version of GDB is supported
60 for customers of Cygnus Solutions. Type "show warranty" for details.
61 This GDB was configured as "--host=i686-pc-linux-gnu
62 --target=arm-elf"...(no debugging symbols found)...
63 (gdb) set remotebaud 38400
64 (gdb) tar rem /dev/ttyS0
65 Remote debugging using /dev/ttyS0
68 Loading section .rom_vectors, size 0x44 lma 0x20000
69 Loading section .text, size 0xf06c lma 0x20044
70 Loading section .rodata, size 0x19a8 lma 0x2f0b0
71 Loading section .data, size 0x474 lma 0x30a58
72 Start address 0x20044 , load size 69324
73 Transfer rate: 25208 bits/sec.
75 Ending remote debugging.
78 2. Execute RedBoot from RAM, and initialize the flash filing system.
79 Notes: the key here is the "-o" option which keeps minicom from
81 The magic phrase "$c#63" is important: you must type it in exactly
82 thus. It is the packet which a "continue" command in GDB would send
83 to the target. If you get no response, try "+$c#63" instead.
84 The IP and server info comes from BOOTP, which is how this RedBoot
85 will start up if the flash does not contain good config info.
90 RedBoot(tm) debug environment - built 07:45:57, Aug 7 2000
91 Copyright (C) 2000, Red Hat, Inc.
93 RAM: 0x00000000-0x01000000
94 FLASH: 0x50000000 - 0x50400000, 32 blocks of 0x00020000 bytes ea.
95 IP: 192.168.1.25, Default server: 192.168.1.101
97 About to initialize [format] FLASH image system - are you sure (y/n)? y
98 *** Initialize FLASH Image System
99 Warning: device contents not erased, some blocks may not be usable
100 ... Erase from 0x503c0000-0x50400000: .
101 ... Program from 0x00fb0000-0x00fb0400 at 0x503c0000: .
104 3. Program RedBoot image into FLASH:
105 This expects the file redboot-post.srec (see below) to exist in the
106 TFTP server space on the server that answered the BOOTP request.
107 It loads into the free flash memory following the boot firmware, at
110 RedBoot> lo -v /tftpboot/redboot-post.srec -b 0x00100000
111 Address offset = bf100000
112 Entry point: 0x50040044, address range: 0x50040000-0x50051384
113 RedBoot> fi cr RedBoot[post] -f 0x50040000 -b 0x00100000 -l 0x20000
114 An image named 'RedBoot[post]' exists - are you sure (y/n)? y
115 ... Erase from 0x50040000-0x50060000: .
116 ... Program from 0x00100000-0x00120000 at 0x50040000: .
117 ... Erase from 0x503c0000-0x50400000: .
118 ... Program from 0x00fb0000-0x00ff0000 at 0x503c0000: .
121 ****reset the board here, leaving your terminal program connected****
123 RedBoot(tm) debug environment - built 07:47:35, Aug 7 2000
124 Copyright (C) 2000, Red Hat, Inc.
126 RAM: 0x00000000-0x01000000
127 FLASH: 0x50000000 - 0x50400000, 32 blocks of 0x00020000 bytes ea.
128 IP: 192.168.1.25, Default server: 192.168.1.101
132 4. Install RAM based RedBoot for backup/update:
133 Similar considerations apply: redboot-ram.srec must be an S-record
134 version of RedBoot built for RAM startup.
136 RedBoot> lo -v /tftpboot/redboot-ram.srec
137 Entry point: 0x00020044, address range: 0x00020000-0x00030ecc
138 RedBoot> fi cr RedBoot[backup] -f 0x50060000 -b 0x20000 -r 0x20000 -l 0x20000
139 An image named 'RedBoot[backup]' exists - are you sure (y/n)? y
140 ... Erase from 0x50060000-0x50080000: .
141 ... Program from 0x00020000-0x00040000 at 0x50060000: .
142 ... Erase from 0x503c0000-0x50400000: .
143 ... Program from 0x00fb0000-0x00ff0000 at 0x503c0000: .
146 You have now updated your board completely. Phew!
150 5. To update RedBoot with a new version of RedBoot, it is necessary to run
151 a RAM-based version of RedBoot which itself re-writes the ROM-based one,
152 because you can't re-write the code that is executing at the time.
154 RedBoot> fi lo RedBoot[backup]
157 RedBoot(tm) debug environment - built 07:45:57, Aug 7 2000
158 Copyright (C) 2000, Red Hat, Inc.
160 RAM: 0x00000000-0x01000000
161 FLASH: 0x50000000 - 0x50400000, 32 blocks of 0x00020000 bytes ea.
162 IP: 192.168.1.25, Default server: 192.168.1.101
165 .. continue with step 3, using whatever your new boot image is called
166 in the TFTP-place, in .srec format.
169 You probably also want to set up then environment with your own IP
170 addresses and so on. Recall that this IP address is the one you use for
171 GDB to talk to the board, not the IP address which the eCos application
172 will take on (by BOOTP/DHCP or whatever means according to configury as
176 Network debug at boot time: false
177 Use BOOTP for network configuration: false
178 Local IP address: 192.168.1.25
179 Default server IP address: 192.168.1.101
180 GDB connection port: 1000
181 Run script at boot: false
185 RedBoot for the nanoEngine/commEngine "nano" Target
186 ---------------------------------------------------
188 Unlike other targets, the nanoEngine comes equipped with boot firmware
189 which you cannot modify. See chapter 5 "nanoEngine Firmware" of the
190 nanoEngine Hardware Reference Manual (we refer to "July 17, 2000 Rev 0.6")
191 from Bright Star Engineering.
193 Because of this, eCos and so Redboot supports only these two startup types:
194 RAM and POST, rather than the more usual ROM, RAM and optionally POST.
196 Briefly, the POST-startup RedBoot image lives in flash following the BSE
197 firmware. The BSE firmware is configured, using its standard "bootcmd"
198 parameter, to jump into the RedBoot image at startup.
200 You can perform the initial load of the POST-startup RedBoot image into
201 flash using the BSE firmware's "load" command. This will load, using TFTP,
202 a binary file and program it into flash in one neat operation. Because no
203 memory management is used in the BSE firmware, flash is mapped from address
204 zero upwards, so the address for the RedBoot POST image is 0x40000. You
205 must use the binary version of RedBoot for this, "redboot-post.bin"
207 This assumes you have set up the other BSE firmware config parameters such
208 that it can communicate over your network, to your TFTP server.
211 >load /tftpboot/redboot-post.bin 40000
212 loading ... erasing blk at 00040000
213 erasing blk at 00050000
214 94168 bytes loaded cksum 00008579
217 > set bootcmd "go 40000"
220 netmask = 255.255.255.0
222 gateway = 10.16.19.66
223 serverip = 10.16.19.66
227 NB: the BSE firmware runs its serial IO at 9600 Baud; RedBoot runs instead
228 at 38400 Baud. You must select the right baud rate in your terminal
229 program to be able to set up the BSE firmware.
231 After a reset, the BSE firmware will print
232 Boot: BSE 2000 Sep 12 2000 14:00:30
233 autoboot: "go 40000" [hit ESC to abort]
234 and then RedBoot starts, switching to 38400 Baud.
236 Once you have installed a bootable RedBoot in the system in this manner, we
237 advice re-installing using the generic method described first in this note
238 in order that the Flash Image System contains an appropriate description of
242 Rebuilding RedBoot from Source
243 ------------------------------
245 To rebuild RedBoot from source, first locate the configuration export files
246 for your platform in the eCos source repository. The RAM and POST startup
247 configuration exports can usually be found in a directory named "misc" in
248 the platform HAL in the eCos source repository, named either:
249 2164 Nov 29 14:59 misc/redboot_RAM.cfg
250 2221 Nov 29 14:59 misc/redboot_POST.cfg
252 1432 Feb 1 13:27 misc/redboot_RAM.ecm
253 1487 Feb 1 14:38 misc/redboot_POST.ecm
254 Having located these files, copy them say to /tmp, say, for less typing.
256 To make redboot for RAM startup:
259 ecosconfig new nano redboot
260 ecosconfig import /tmp/redboot_RAM.ecm
264 To build the POST version, in a different build/config directory, just use
265 the config export redboot_POST.ecm (or .cfg) instead.
267 The resulting files will be, in each of the POST and RAM startup build
269 70456 ..../install/bin/redboot.bin
270 433104 ..../install/bin/redboot.elf
271 91407 ..../install/bin/redboot.img
272 194732 ..../install/bin/redboot.srec
274 The .elf and .srec files have the obvious relationship to those supplied in
275 the "loaders/nano" directory in the install.
278 Cohabiting with POST in Flash
279 -----------------------------
281 The configuration export named redboot_POST.ecm configures redboot to build
282 for execution at address 0x50040000 (or during bootup, 0x00040000). This
283 is to allow power-on self-test (POST) code or immutable firmware to live in
284 the lower addresses of the flash and to run before RedBoot gets control.
285 The assumption is that RedBoot will be entered at its base address in
286 physical memory, ie. 0x00040000. Alternatively, for testing, you can call
287 it in an already running system by "go 0x50040040" at another RedBoot
288 prompt, or a branch to that address; the address is where the reset vector
289 points, and is reported by RedBoot's tftp load command and listed by the
290 fis list command, amongst other places.
292 Using the POST configuration enables a normal config option which causes
293 linking and initialization against memory layout files called "...post..."
294 rather than "...rom..." or "...ram..." in the include/pkgconf directory,
296 665 Feb 9 17:57 include/pkgconf/mlt_arm_sa11x0_nano_post.h
297 839 Feb 9 17:57 include/pkgconf/mlt_arm_sa11x0_nano_post.ldi
298 585 Feb 9 17:57 include/pkgconf/mlt_arm_sa11x0_nano_post.mlt
299 It is these you should edit if you wish to move that execution address from
300 0x50040000 in the POST configuration. Startup type naturally remains ROM
301 in this configuration.
303 Because the nanoEngine contains immutable boot firmware at the start of
304 flash, RedBoot for this target is configured to reserve that area in the
305 Flash Image System, and to create by default an entry for the POST startup
309 Name FLASH addr Mem addr Length Entry point
310 (reserved) 0x50000000 0x50000000 0x00040000 0x00000000
311 RedBoot[post] 0x50040000 0x00100000 0x00020000 0x50040040
312 RedBoot[backup] 0x50060000 0x00020000 0x00020000 0x00020040
313 RedBoot config 0x503E0000 0x503E0000 0x00010000 0x00000000
314 FIS directory 0x503F0000 0x503F0000 0x00010000 0x00000000
317 The entry "(reserved)" ensures that the FIS cannot attempt to overwrite the
318 BSE firmware, thus ensuring that the board remains bootable and recoverable
319 even after installing a broken RedBoot image.
322 Special Redboot Commands
323 ------------------------
325 The nanoEngine/commEngine has one or two Intel i82559 Ethernet controllers
326 installed, but these have no associated serial EEPROM in which to record
327 their Ethernet Station Address (ESA, or MAC address). The BSE firmware
328 records an ESA for the device it uses, but this information is not
329 available to RedBoot; we cannot share it.
331 To keep the ESAs for the two ethernet interfaces, two new items of RedBoot
332 configuration data are introduced. You can list them with the RedBoot
333 command "fconfig -l" thus:
336 Run script at boot: false
337 Use BOOTP for network configuration: false
338 Local IP address: 10.16.19.91
339 Default server IP address: 10.16.19.66
340 Network hardware address [MAC] for eth0: 0x00:0xB5:0xE0:0xB5:0xE0:0x99
341 Network hardware address [MAC] for eth1: 0x00:0xB5:0xE0:0xB5:0xE0:0x9A
342 GDB connection port: 9000
343 Network debug at boot time: false
346 You should set them before running RedBoot or eCos applications with the
347 board connected to a network. The fconfig command can be used as for any
348 configuration data item; the entire ESA is entered in one line.
354 The first level page table is located at physical address
355 0xc0004000. No second level tables are used.
358 The virtual memory maps in this section use a C and B column to
359 indicate whether or not the region is cached (C) or buffered (B).
361 Physical Address Range Description
362 ----------------------- ----------------------------------
363 0x00000000 - 0x003fffff 4Mb FLASH (nCS0)
364 0x18000000 - 0x18ffffff Internal PCI bus - 2 x i82559 ethernet
365 0x40000000 - 0x4fffffff External IO or PCI bus
366 0x80000000 - 0xbfffffff SA-1110 Internal Registers
367 0xc0000000 - 0xc7ffffff DRAM Bank 0 - 32Mb SDRAM
368 0xc8000000 - 0xcfffffff DRAM Bank 1 - empty
369 0xe0000000 - 0xe7ffffff Cache Clean
371 Virtual Address Range C B Description
372 ----------------------- - - ----------------------------------
373 0x00000000 - 0x001fffff Y Y DRAM - 8Mb to 32Mb
374 0x18000000 - 0x180fffff N N Internal PCI bus - 2 x i82559 ethernet
375 0x40000000 - 0x4fffffff N N External IO or PCI bus
376 0x50000000 - 0x51ffffff Y Y Up to 32Mb FLASH (nCS0)
377 0x80000000 - 0xbfffffff N N SA-1110 Internal Registers
378 0xc0000000 - 0xc0ffffff N Y DRAM Bank 0: 8 or 16Mb
379 0xc8000000 - 0xc8ffffff N Y DRAM Bank 1: 8 or 16Mb or absent
380 0xe0000000 - 0xe7ffffff Y Y Cache Clean
382 The FLASH based RedBoot POST-startup image occupies virtual addresses
383 0x50040000 - 0x5005ffff.
385 The ethernet devices use a "PCI window" to communicate with the CPU. This
386 is 1Mb of SDRAM which is shared with the ethernet devices that are on the
387 PCI bus. It is neither cached nor buffered, to ensure that CPU and PCI
388 accesses see correct data in the correct order. By default it is
389 configured to be megabyte number 30, at addresses 0x01e00000-0x01efffff.
390 This can be modified - and indeed must be, if less than 32Mb of SDRAM is
391 installed - via the memory layout tool, or by moving the section
392 "__pci_window" referred to by symbols CYGMEM_SECTION_pci_window* in the
395 Though the nanoEngine ships with 32Mb of SDRAM all attached to DRAM bank 0,
396 the code can cope with any of these combinations also; "2 x " in this
397 context means one device in each DRAM Bank.
399 1 x 8Mb = 8Mb 2 x 8Mb = 16Mb
400 1 x 16Mb = 16Mb 2 x 16Mb = 32Mb
402 All are programmed the same in the memory controller.
404 Startup code detects which is fitted and programs the memory map
405 accordingly. If the device(s) is 8Mb, then there are gaps in the
406 physical memory map, because a high order address bit is not
407 connected. The gaps are the higher 2Mb out of every 4Mb.
409 The SA11x0 OS timer is used as a polled timer to provide timeout
410 support within RedBoot.
416 The nano is in the set of SA11X0-based platforms. It uses the
417 arm architectural HAL, the sa11x0 variant HAL, plus the nano
418 platform hal. These are components
419 CYGPKG_HAL_ARM hal/arm/arch/
420 CYGPKG_HAL_ARM_SA11X0 hal/arm/sa11x0/var
421 CYGPKG_HAL_ARM_SA11X0_NANO hal/arm/sa11x0/nano
424 The target name is "nano" which includes all these, plus the
425 ethernet driver packages, flash driver, and so on.
431 The ethernet driver is in two parts:
433 A generic ether driver for Intel i8255x series devices, specifically the
434 i82559, is devs/eth/intel/i82559. Its package name is
435 CYGPKG_DEVS_ETH_INTEL_I82559.
437 The platform-specific ether driver is devs/eth/arm/nano. Its package is
438 CYGPKG_DEVS_ETH_ARM_NANO. This tells the generic driver the address in IO
439 memory of the chip, for example, and other configuration details.
441 This driver picks up the ESA from RedBoot's configuration data - unless
442 configured to use a static ESA in the usual manner.