Difference between revisions of "Flameman/dht-walnut/firmware"
(Created page with 'blablabla') |
|||
Line 1: | Line 1: | ||
− | + | = Firnware Bootloaders = | |
+ | |||
+ | * ppcboot (not suggested) | ||
+ | * U-Boot (it can't load kernel >=2.5.25) | ||
+ | * U-Boot-kanojio (under development, it will be able to boot kernel >2.6.25, see below) | ||
+ | |||
+ | |||
+ | == U-Boot 1.1.4 == | ||
+ | |||
+ | !!!NOTE!!! | ||
+ | uboot-v1.1.4 has an issue with tftp-boot ramrootfs, but it works well with disk-boot, you'd better use uboot-v1.2 for a good firmware replacement: good and solid rock state out of my tests ! | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | |||
+ | uboot is a significantly updated replacement for ppcboot. | ||
+ | U-Boot for the DHT-Walnut | ||
+ | [http://www.denx.de/wiki/view/DULG/Manual?stickboard=walnut DENX U-Boot and Linux Guide for Walnut ] | ||
+ | |||
+ | * Information on U-Boot can be found at [http://u-boot.sourceforge.net/] | ||
+ | * The source for U-Boot 1.1.4 is downloadable from ftp://ftp.denx.de/pub/u-boot/u-boot-1.1.4.tar.bz2 | ||
+ | * Here is a patch that makes it work on the DHT-Walnut: [http://www.farnsworth.org/linuxppc/u-boot-dht-walnut-df2.patch u-boot-dht-walnut-df2.patch]. | ||
+ | * A binary that can be copied to the DHT-Walnut flash at 0xfffc0000 is available here: [http://www.farnsworth.org/linuxppc/u-boot-1.1.4-df2.bin u-boot-1.1.4-df2.bin] | ||
+ | |||
+ | Changes since u-boot-1.1.4-df1.bin: | ||
+ | * A default ethaddr is now set: de:ad:be:ef:00:00 | ||
+ | * The ethaddr can be changed as often as you like. Use: ''setenv ethaddr be:ef:be:ef:be:ef ; saveenv'' | ||
+ | * Only the first two memory banks of a DIMM are used. This allows us to use (half of) double-sided DIMMS. | ||
+ | |||
+ | Some things to note when changing from ppcboot to U-Boot: | ||
+ | * Default baudrate is 115200. | ||
+ | * Occupies flash addresses 0xfffc0000-0xffffffff | ||
+ | * Maintains two copies of environment data, primary copy at 0xfffb0000, backup copy at 0xfffa0000. | ||
+ | |||
+ | === Installing === | ||
+ | |||
+ | * Boot the board and bring it to the ppcboot (or U-Boot) console prompt. | ||
+ | * Download the new bootloader u-boot-1.1.4-df2.bin into RAM: | ||
+ | |||
+ | (1) Using Kermit (you'll need a terminal emulator that supports the kermit file transfer mode): loadb 800000 115200'' | ||
+ | * Switch baudrate to 115200 bps and press ENTER ... | ||
+ | * Ready for binary (kermit) download ... | ||
+ | * Start Addr=0x00800000 | ||
+ | * Switch baudrate to 9600 bps and press ESC ... | ||
+ | |||
+ | (2) Using tftpboot (requires a tftp server and setting the environment variables ethaddr, ipaddr and serverip) | ||
+ | * tftpboot 800000 u-boot-1.1.4-df2.bin Using ppc_4xx_eth0 device | ||
+ | * TFTP from server 192.168.1.1; our IP address is 192.168.1.2 | ||
+ | * Filename 'u-boot.bin'. | ||
+ | * Load address: 0x800000 | ||
+ | * Loading: done | ||
+ | * Bytes transferred = 262144 (40000 hex) | ||
+ | * Verify that the download was received correctly (crc should be 0xd3cef189): | ||
+ | * crc 800000 40000 | ||
+ | * CRC32 for 00800000 ... 0083ffff ==> d3cef189 | ||
+ | * Unprotect the last 4 sectors: | ||
+ | * protect off fffc0000 ffffffff | ||
+ | * Un-Protected 4 sectors | ||
+ | |||
+ | '''From this point on, do *not* power down the board, and type *very* carefully. This is the critical section.''' | ||
+ | |||
+ | * Erase the last four sectors: | ||
+ | * erase fffc0000 ffffffff | ||
+ | * Erase Flash from 0xfffc0000 to 0xffffffff | ||
+ | * Erasing sector fffc0000 | ||
+ | * Erasing sector fffd0000 | ||
+ | * Erasing sector fffe0000 | ||
+ | * Erasing sector ffff0000 | ||
+ | * done | ||
+ | * Erased 4 sectors | ||
+ | * Copy the new bootloader into flash: | ||
+ | * cp.b 800000 fffc0000 40000 | ||
+ | * Copy to Flash... done | ||
+ | * Verify that the image is correct (crc of u-boot-1.1.4-df2.bin is 0xd3cef189). | ||
+ | * crc fffc0000 40000 | ||
+ | * CRC32 for fffc0000 ... ffffffff ==> d3cef189 | ||
+ | |||
+ | '''End of critical section. Congratulations!''' | ||
+ | |||
+ | * Reset the board and see that the new version booted! | ||
+ | * Don't forget to change your baud rate to 115200! | ||
+ | * reset | ||
+ | |||
+ | You will see a message like : *** Warning - bad CRC, using default environment. That's normal. It will go away after you issue a ''saveenv'' command. | ||
+ | |||
+ | == ppcboot 1.1.6 == | ||
+ | |||
+ | the latest ported ppcboot is 1.1.6, it need a patch and it will build for flashing at 0xfff80000 as a replacement for the pcboot-1.1.2 that comes with the board. | ||
+ | |||
+ | * sources ftp://ftp.denx.de/pub/ppcboot/ppcboot-1.1.6.tar.bz2 | ||
+ | * patch [[Media:patch-ppcboot-1.1.6-km2|patch-ppcboot-1.1.6-km2]] | ||
+ | * binary [[Media:ppcboot1.1.6.1.bin|ppcboot1.1.6.1.bin]] crc = 083fb0a3 | ||
+ | |||
+ | |||
+ | === Installing === | ||
+ | |||
+ | Quick notes on installing ppcboot v1.1.6.1 | ||
+ | |||
+ | * Boot the board and bring it to the ppcboot console prompt. | ||
+ | * Check current flash configuration: | ||
+ | |||
+ | => ''flinfo'' | ||
+ | |||
+ | <pre>Bank # 1: AMD AM29F040 (512 Kbit, uniform sector size) | ||
+ | Size: 512 KB in 8 Sectors | ||
+ | Sector Start Addresses: | ||
+ | FFF80000 RO FFF90000 RO FFFA0000 RO FFFB0000 FFFC0000 | ||
+ | FFFD0000 FFFE0000 FFFF0000 </pre> | ||
+ | |||
+ | |||
+ | Note that the bottom three sectors, containing the existing 1.1.2 bootloader, are protected. | ||
+ | We also want to protect the last sector, which contains the initial jump instruction, so: | ||
+ | |||
+ | => ''protect on ffff0000 ffffffff'' | ||
+ | |||
+ | <pre>Protected 1 sectors | ||
+ | </pre> | ||
+ | |||
+ | * Zero out a section of ram before the download: | ||
+ | |||
+ | => ''mw.b 400000 0 30000'' | ||
+ | * Now download the new bootloader [http://elinux.org/wiki/DHT-Walnut?action=AttachFile&do=get&target=ppcboot1.1.6.1.bin ppcboot1.1.6.1.bin] into ram (you'll need a terminal emulator that supports the kermit file transfer mode): | ||
+ | |||
+ | => ''loadb 400000 115200'' | ||
+ | |||
+ | <pre>## Switch baudrate to 115200 bps and press ENTER ... | ||
+ | ## Ready for binary (kermit) download ... | ||
+ | ## Start Addr = 0x00400000 | ||
+ | ## Switch baudrate to 9600 bps and press ESC ... | ||
+ | </pre> | ||
+ | |||
+ | * Verify that the download was received correctly (crc should be 0x083fb0a3): | ||
+ | |||
+ | => ''crc 400000 30000'' | ||
+ | |||
+ | <pre>CRC32 for 00400000 ... 0042ffff ==> 083fb0a3 | ||
+ | </pre> | ||
+ | |||
+ | * Erase the three spare sectors, which we'll use to backup the 1.1.2 bootloader: | ||
+ | |||
+ | => ''erase fffc0000 fffeffff'' | ||
+ | |||
+ | <pre>Erase Flash from 0xfffc0000 to 0xfffeffff | ||
+ | Erasing sector fffc0000 | ||
+ | .Erasing sector fffd0000 | ||
+ | .Erasing sector fffe0000 | ||
+ | . done | ||
+ | Erased 3 sectors</pre> | ||
+ | |||
+ | * (Optional: erase the 0xfffb0000 sector, which will be used for non-volatile environment storage.) | ||
+ | |||
+ | => ''erase fffb0000 fffbffff'' | ||
+ | |||
+ | <pre>Erase Flash from 0xfffb0000 to 0xfffbffff | ||
+ | Erasing sector fffb0000 | ||
+ | . done | ||
+ | Erased 1 sectors</pre> | ||
+ | |||
+ | * Check that sectors 0xfffc0000 to 0xfffe0000 are erased, and sector 0xffff0000 is protected: | ||
+ | |||
+ | => ''flinfo'' | ||
+ | |||
+ | <pre>Bank # 1: AMD AM29F040 (512 Kbit, uniform sector size) | ||
+ | Size: 512 KB in 8 Sectors | ||
+ | Sector Start Addresses: | ||
+ | FFF80000 RO FFF90000 RO FFFA0000 RO FFFB0000 E FFFC0000 E | ||
+ | FFFD0000 E FFFE0000 E FFFF0000 RO </pre> | ||
+ | |||
+ | * Now we're ready to backup the 1.1.2 bootloader. Copy three sectors from 0xfff80000 to 0xfffc0000: | ||
+ | |||
+ | => ''cp.b fff80000 fffc0000 30000'' | ||
+ | |||
+ | <pre>Copy to Flash... done | ||
+ | </pre> | ||
+ | |||
+ | * Easy enough, right? Compare just to be sure it went ok: | ||
+ | |||
+ | => ''cmp.b fff80000 fffc0000 30000'' | ||
+ | |||
+ | <pre>Total of 196608 bytes were the same | ||
+ | </pre> | ||
+ | |||
+ | * Now we're ready to modify the bootsectors. We'll turn off protection, erase the three bottom sectors, and copy the new 1.1.6.1 bootloader from ram. | ||
+ | |||
+ | * Unprotect the bottom three sectors: | ||
+ | => ''protect off fff80000 fffaffff'' | ||
+ | |||
+ | <pre>Un-Protected 3 sectors | ||
+ | </pre> | ||
+ | |||
+ | '''From this point on, do *not* power down the board. This is the critical section.''' | ||
+ | * Erase the bottom three sectors with the original 1.1.2 bootloader: | ||
+ | |||
+ | => ''erase fff80000 fffaffff'' | ||
+ | |||
+ | <pre>Erase Flash from 0xfff80000 to 0xfffaffff | ||
+ | Erasing sector fff80000 | ||
+ | .Erasing sector fff90000 | ||
+ | .Erasing sector fffa0000 | ||
+ | . done | ||
+ | Erased 3 sectors</pre> | ||
+ | |||
+ | * Copy the new bootloader into flash: | ||
+ | => ''cp.b 400000 fff80000 30000'' | ||
+ | |||
+ | <pre>Copy to Flash... done | ||
+ | </pre> | ||
+ | |||
+ | * Verify the copy: | ||
+ | => ''cmp.b 400000 fff80000 30000'' | ||
+ | |||
+ | <pre>Total of 196608 bytes were the same | ||
+ | </pre> | ||
+ | |||
+ | * Verify that the image is correct (crc of ppcboot1.1.6.1.bin is 0x083fb0a3). | ||
+ | => ''crc fff80000 30000'' | ||
+ | |||
+ | <pre>CRC32 for fff80000 ... fffaffff ==> 083fb0a3 | ||
+ | </pre> | ||
+ | |||
+ | '''End of critical section. Congratulations'''' | ||
+ | |||
+ | * We've finished modifying flash, so turn the write protection back on: | ||
+ | => ''protect on fff80000 fffaffff'' | ||
+ | |||
+ | <pre>Protected 3 sectors | ||
+ | </pre> | ||
+ | |||
+ | * Reset the board and see that the new version booted | ||
+ | |||
+ | => ''reset'' | ||
+ | |||
+ | <pre> | ||
+ | PPCBoot 1.1.6 (Feb 5 2006 - 21:38:51) | ||
+ | |||
+ | CPU: IBM PowerPC 405GP Rev. E at 266.640 MHz (PLB=66, OPB=33, EBC=33 MHz) | ||
+ | PCI async ext clock used, internal PCI arbiter enabled | ||
+ | 16 kB I-Cache 8 kB D-Cache | ||
+ | </pre> | ||
+ | |||
+ | |||
+ | To sum up, you'll end up executing these commands: | ||
+ | |||
+ | => ''protect on ffff0000 ffffffff'' | ||
+ | |||
+ | => ''mw.b 400000 0 30000'' | ||
+ | |||
+ | => ''loadb 400000 115200'' | ||
+ | |||
+ | => ''crc 400000 30000'' | ||
+ | |||
+ | => ''erase fffc0000 fffeffff'' | ||
+ | |||
+ | => ''cp.b fff80000 fffc0000 30000'' | ||
+ | |||
+ | => ''cmp.b fff80000 fffc0000 30000'' | ||
+ | |||
+ | => ''protect off fff80000 fffaffff'' | ||
+ | |||
+ | => ''erase fff80000 fffaffff'' | ||
+ | |||
+ | => ''cp.b 400000 fff80000 30000'' | ||
+ | |||
+ | => ''cmp.b 400000 fff80000 30000'' | ||
+ | |||
+ | => ''crc fff80000 30000'' | ||
+ | |||
+ | => ''protect on fff80000 fffaffff'' | ||
+ | |||
+ | == new firmware, uboot-v1.2-hack (the most mature i suggest) == | ||
+ | |||
+ | === brief about how to install on flash === | ||
+ | |||
+ | <pre> | ||
+ | |||
+ | => printenv | ||
+ | stdin=serial | ||
+ | stdout=serial | ||
+ | stderr=serial | ||
+ | ... | ||
+ | |||
+ | => setenv baudrate 9600 | ||
+ | => setenv loads_echo 1 | ||
+ | => ethaddr DE:AD:BE:EF:DE:AD | ||
+ | => ethaddr serverip 192.168.1.14 | ||
+ | => ethaddr ipaddr 192.168.1.2 | ||
+ | => tftpboot 800000 uboot-v1.2.img | ||
+ | TFTP from server 192.168.1.14; our IP address is 192.$ | ||
+ | Filename 'uboot-v1.2.img'. | ||
+ | Load address: 0x800000 | ||
+ | Loading: *^H#########################################$ | ||
+ | done | ||
+ | Bytes transferred = 262144 (40000 hex) | ||
+ | |||
+ | => crc 800000 40000 | ||
+ | CRC32 for 00800000 ... 0083ffff ==> 3aae52fa | ||
+ | |||
+ | => protect off fffc0000 ffffffff | ||
+ | Un-Protected 4 sectors | ||
+ | |||
+ | => erase fffc0000 ffffffff | ||
+ | Erase Flash from 0xfffc0000 to 0xffffffff | ||
+ | Erasing sector fffc0000 | ||
+ | .Erasing sector fffd0000 | ||
+ | .Erasing sector fffe0000 | ||
+ | .Erasing sector ffff0000 | ||
+ | . done | ||
+ | Erased 4 sectors | ||
+ | |||
+ | => cp.b 800000 fffc0000 40000 | ||
+ | Copy to Flash... done | ||
+ | |||
+ | => crc fffc0000 40000 | ||
+ | CRC32 for fffc0000 ... ffffffff ==> 3aae52fa | ||
+ | |||
+ | => protect on fffc0000 ffffffff | ||
+ | => reset | ||
+ | </pre> | ||
+ | |||
+ | === brief about set baud and env === | ||
+ | |||
+ | <pre> | ||
+ | # setenv baudrate 9600 | ||
+ | ## Switch baudrate to 9600 bps and press ENTER ... | ||
+ | |||
+ | # saveenv | ||
+ | Saving Environment to Flash... | ||
+ | Un-Protected 1 sectors | ||
+ | Un-Protected 1 sectors | ||
+ | Erasing Flash... | ||
+ | . done | ||
+ | Erased 1 sectors | ||
+ | Writing to Flash... done | ||
+ | Protected 1 sectors | ||
+ | Protected 1 sectors | ||
+ | </pre> | ||
+ | |||
+ | |||
+ | download | ||
+ | |||
+ | crc (40000) = 3aae52fa | ||
+ | |||
+ | === issues === | ||
+ | |||
+ | <pre> | ||
+ | |||
+ | ... | ||
+ | |||
+ | </pre> | ||
+ | |||
+ | == uboot-2009 (not mature, not good, under development) == | ||
+ | |||
+ | it's under development, it will released soon | ||
+ | |||
+ | status: | ||
+ | * uboot-1.2.0-hack-new: tftpboot is working with ramrootfs, ide is working | ||
+ | * uboot-2009: tftpboot is working with ramrootfs, ide is not working, eth0 issued, tftpboot issued with a download > 6Mb | ||
+ | |||
+ | |||
+ | == uboot-kanojio == | ||
+ | |||
+ | kernel>=2.6.25 requires ARCH=POWERPC, but they simply do not boot with uBoot: it seems the problem is that no "old-style" uImage is available for dht-walnut/walnut in unified powerpc source; it now requires the device tree. | ||
+ | |||
+ | <pre> | ||
+ | From Documentation/powerpc/bootwrapper.txt: | ||
+ | |||
+ | uImage: Native image format used by U-Boot. The uImage target | ||
+ | does not add any boot code. It just wraps a compressed | ||
+ | vmlinux in the uImage data structure. This image | ||
+ | requires a version of U-Boot that is able to pass | ||
+ | a device tree to the kernel at boot. If using an older | ||
+ | version of U-Boot, then you need to use a cuImage | ||
+ | instead. | ||
+ | </pre> | ||
+ | |||
+ | There is no walnut cuImage(???), so the only choice is to use this | ||
+ | "new-style" uImage and have uboot pass a walnut device-tree file | ||
+ | to the kernel. | ||
+ | |||
+ | device-tree stuff is NOT supported with uboot, so ... you may use the new kanojio boot second stage loader | ||
+ | |||
+ | |||
+ | === second stage kexec boot loader === | ||
+ | |||
+ | uboot is the first stage bootloader, it's the first thing fetched by the cpu when you switch on the board. | ||
+ | |||
+ | the suggested (and hacked) uboot release is working fine, it's able to RAW read a PC partition from the hard drive putting the contents on the ram .. you could load a kernel from the HD and boot it. | ||
+ | |||
+ | it is also able to tftp a kernel from the net, but .. a bug is surviving from the 1.1.* release: this bug is limiting the amount of data you can tftp boot: 4.5Mb ! | ||
+ | |||
+ | if your kernel+ramrootf is greater than 4.5Mb it will not be decompressed right cause of memory corruption (probably cause of a buffer overflow somewhere i dunno in the firmware) | ||
+ | |||
+ | so ! i developed a special second stage boot loader: it will be smaller than 4.5Mb and it will able to boot from net, pata, sata, scsi, firewire | ||
+ | |||
+ | and it should be able to read and boot all the binary format: elf, uImage, zImage, ecc | ||
+ | |||
+ | |||
+ | ==== first shot, the proof of concept ==== | ||
+ | |||
+ | <pre> | ||
+ | [ .k.a.n.o.j.o. ] | ||
+ | kexec boot loader | ||
+ | v01.2, 2010-01-28 | ||
+ | |||
+ | press a key to stop the autoboot process | ||
+ | |||
+ | # cmdlist | ||
+ | 231 help | ||
+ | 230 cmdlist | ||
+ | 252 ver | ||
+ | 232 macaddr | ||
+ | 233 tcpscan | ||
+ | 234 ifconfig | ||
+ | 235 endian | ||
+ | 236 ttftp | ||
+ | 240 exec | ||
+ | 241 cmdline | ||
+ | 237 env | ||
+ | 237 printenv | ||
+ | 238 saveenv | ||
+ | 239 setenv | ||
+ | 254 | ||
+ | 255 reboot | ||
+ | 255 exit | ||
+ | |||
+ | # help printenv | ||
+ | show all the environment entries | ||
+ | |||
+ | # printenv | ||
+ | env.machinename="dht-walnut" | ||
+ | env.root="/dev/hda3,ro" | ||
+ | env.fstype="ext3" | ||
+ | env.console="ttyS0,9600" | ||
+ | env.net_dev="eth0" | ||
+ | env.net_ip="192.168.1.11" | ||
+ | env.net_mask="255.255.255.0" | ||
+ | env.ttftp_server_ip="192.168.1.14" | ||
+ | env.ttftp_server_port="2001" | ||
+ | env.rmshell_port="2002" | ||
+ | env.timeout="5s" | ||
+ | env.boot="net" | ||
+ | env.bootfile="dht-walnut--kernel-2.6.22-ramrootfs.img" | ||
+ | env.net="ttftp $ttfpt_server_ip $ttftp_server_port $bootfile autoexec" | ||
+ | |||
+ | # ttftp | ||
+ | connect(): Connection refused, no ttftp server found | ||
+ | |||
+ | # tcpscan $ttftp_server 1 2100 | ||
+ | TCP port scanning | ||
+ | connect_port={ 22 23 80 111 443 2000} | ||
+ | |||
+ | # setenv ttftp_server_port 2000 | ||
+ | |||
+ | # boot | ||
+ | method=net | ||
+ | downloading "dht-walnut--kernel-2.6.22-ramrootfs.img" from 192.168.1.14/2000 ... done | ||
+ | kexec ... kernel loaded into ram ... jumping to it | ||
+ | </pre> | ||
+ | |||
+ | i will release as soon as possible |
Revision as of 03:14, 31 January 2010
Contents
Firnware Bootloaders
- ppcboot (not suggested)
- U-Boot (it can't load kernel >=2.5.25)
- U-Boot-kanojio (under development, it will be able to boot kernel >2.6.25, see below)
U-Boot 1.1.4
!!!NOTE!!! uboot-v1.1.4 has an issue with tftp-boot ramrootfs, but it works well with disk-boot, you'd better use uboot-v1.2 for a good firmware replacement: good and solid rock state out of my tests !
uboot is a significantly updated replacement for ppcboot. U-Boot for the DHT-Walnut DENX U-Boot and Linux Guide for Walnut
- Information on U-Boot can be found at [1]
- The source for U-Boot 1.1.4 is downloadable from ftp://ftp.denx.de/pub/u-boot/u-boot-1.1.4.tar.bz2
- Here is a patch that makes it work on the DHT-Walnut: u-boot-dht-walnut-df2.patch.
- A binary that can be copied to the DHT-Walnut flash at 0xfffc0000 is available here: u-boot-1.1.4-df2.bin
Changes since u-boot-1.1.4-df1.bin:
- A default ethaddr is now set: de:ad:be:ef:00:00
- The ethaddr can be changed as often as you like. Use: setenv ethaddr be:ef:be:ef:be:ef ; saveenv
- Only the first two memory banks of a DIMM are used. This allows us to use (half of) double-sided DIMMS.
Some things to note when changing from ppcboot to U-Boot:
- Default baudrate is 115200.
- Occupies flash addresses 0xfffc0000-0xffffffff
- Maintains two copies of environment data, primary copy at 0xfffb0000, backup copy at 0xfffa0000.
Installing
- Boot the board and bring it to the ppcboot (or U-Boot) console prompt.
- Download the new bootloader u-boot-1.1.4-df2.bin into RAM:
(1) Using Kermit (you'll need a terminal emulator that supports the kermit file transfer mode): loadb 800000 115200
- Switch baudrate to 115200 bps and press ENTER ...
- Ready for binary (kermit) download ...
- Start Addr=0x00800000
- Switch baudrate to 9600 bps and press ESC ...
(2) Using tftpboot (requires a tftp server and setting the environment variables ethaddr, ipaddr and serverip)
- tftpboot 800000 u-boot-1.1.4-df2.bin Using ppc_4xx_eth0 device
* TFTP from server 192.168.1.1; our IP address is 192.168.1.2 * Filename 'u-boot.bin'. * Load address: 0x800000 * Loading: done * Bytes transferred = 262144 (40000 hex)
- Verify that the download was received correctly (crc should be 0xd3cef189):
- crc 800000 40000
- CRC32 for 00800000 ... 0083ffff ==> d3cef189
- Unprotect the last 4 sectors:
- protect off fffc0000 ffffffff
- Un-Protected 4 sectors
From this point on, do *not* power down the board, and type *very* carefully. This is the critical section.
- Erase the last four sectors:
- erase fffc0000 ffffffff
* Erase Flash from 0xfffc0000 to 0xffffffff * Erasing sector fffc0000 * Erasing sector fffd0000 * Erasing sector fffe0000 * Erasing sector ffff0000 * done * Erased 4 sectors
- Copy the new bootloader into flash:
- cp.b 800000 fffc0000 40000
* Copy to Flash... done
- Verify that the image is correct (crc of u-boot-1.1.4-df2.bin is 0xd3cef189).
- crc fffc0000 40000
* CRC32 for fffc0000 ... ffffffff ==> d3cef189
End of critical section. Congratulations!
- Reset the board and see that the new version booted!
- Don't forget to change your baud rate to 115200!
- reset
You will see a message like : *** Warning - bad CRC, using default environment. That's normal. It will go away after you issue a saveenv command.
ppcboot 1.1.6
the latest ported ppcboot is 1.1.6, it need a patch and it will build for flashing at 0xfff80000 as a replacement for the pcboot-1.1.2 that comes with the board.
- sources ftp://ftp.denx.de/pub/ppcboot/ppcboot-1.1.6.tar.bz2
- patch patch-ppcboot-1.1.6-km2
- binary ppcboot1.1.6.1.bin crc = 083fb0a3
Installing
Quick notes on installing ppcboot v1.1.6.1
- Boot the board and bring it to the ppcboot console prompt.
- Check current flash configuration:
=> flinfo
Bank # 1: AMD AM29F040 (512 Kbit, uniform sector size) Size: 512 KB in 8 Sectors Sector Start Addresses: FFF80000 RO FFF90000 RO FFFA0000 RO FFFB0000 FFFC0000 FFFD0000 FFFE0000 FFFF0000
Note that the bottom three sectors, containing the existing 1.1.2 bootloader, are protected.
We also want to protect the last sector, which contains the initial jump instruction, so:
=> protect on ffff0000 ffffffff
Protected 1 sectors
- Zero out a section of ram before the download:
=> mw.b 400000 0 30000
- Now download the new bootloader ppcboot1.1.6.1.bin into ram (you'll need a terminal emulator that supports the kermit file transfer mode):
=> loadb 400000 115200
## Switch baudrate to 115200 bps and press ENTER ... ## Ready for binary (kermit) download ... ## Start Addr = 0x00400000 ## Switch baudrate to 9600 bps and press ESC ...
- Verify that the download was received correctly (crc should be 0x083fb0a3):
=> crc 400000 30000
CRC32 for 00400000 ... 0042ffff ==> 083fb0a3
- Erase the three spare sectors, which we'll use to backup the 1.1.2 bootloader:
=> erase fffc0000 fffeffff
Erase Flash from 0xfffc0000 to 0xfffeffff Erasing sector fffc0000 .Erasing sector fffd0000 .Erasing sector fffe0000 . done Erased 3 sectors
- (Optional: erase the 0xfffb0000 sector, which will be used for non-volatile environment storage.)
=> erase fffb0000 fffbffff
Erase Flash from 0xfffb0000 to 0xfffbffff Erasing sector fffb0000 . done Erased 1 sectors
- Check that sectors 0xfffc0000 to 0xfffe0000 are erased, and sector 0xffff0000 is protected:
=> flinfo
Bank # 1: AMD AM29F040 (512 Kbit, uniform sector size) Size: 512 KB in 8 Sectors Sector Start Addresses: FFF80000 RO FFF90000 RO FFFA0000 RO FFFB0000 E FFFC0000 E FFFD0000 E FFFE0000 E FFFF0000 RO
- Now we're ready to backup the 1.1.2 bootloader. Copy three sectors from 0xfff80000 to 0xfffc0000:
=> cp.b fff80000 fffc0000 30000
Copy to Flash... done
- Easy enough, right? Compare just to be sure it went ok:
=> cmp.b fff80000 fffc0000 30000
Total of 196608 bytes were the same
- Now we're ready to modify the bootsectors. We'll turn off protection, erase the three bottom sectors, and copy the new 1.1.6.1 bootloader from ram.
- Unprotect the bottom three sectors:
=> protect off fff80000 fffaffff
Un-Protected 3 sectors
From this point on, do *not* power down the board. This is the critical section.
- Erase the bottom three sectors with the original 1.1.2 bootloader:
=> erase fff80000 fffaffff
Erase Flash from 0xfff80000 to 0xfffaffff Erasing sector fff80000 .Erasing sector fff90000 .Erasing sector fffa0000 . done Erased 3 sectors
- Copy the new bootloader into flash:
=> cp.b 400000 fff80000 30000
Copy to Flash... done
- Verify the copy:
=> cmp.b 400000 fff80000 30000
Total of 196608 bytes were the same
- Verify that the image is correct (crc of ppcboot1.1.6.1.bin is 0x083fb0a3).
=> crc fff80000 30000
CRC32 for fff80000 ... fffaffff ==> 083fb0a3
End of critical section. Congratulations'
- We've finished modifying flash, so turn the write protection back on:
=> protect on fff80000 fffaffff
Protected 3 sectors
- Reset the board and see that the new version booted
=> reset
PPCBoot 1.1.6 (Feb 5 2006 - 21:38:51) CPU: IBM PowerPC 405GP Rev. E at 266.640 MHz (PLB=66, OPB=33, EBC=33 MHz) PCI async ext clock used, internal PCI arbiter enabled 16 kB I-Cache 8 kB D-Cache
To sum up, you'll end up executing these commands:
=> protect on ffff0000 ffffffff
=> mw.b 400000 0 30000
=> loadb 400000 115200
=> crc 400000 30000
=> erase fffc0000 fffeffff
=> cp.b fff80000 fffc0000 30000
=> cmp.b fff80000 fffc0000 30000
=> protect off fff80000 fffaffff
=> erase fff80000 fffaffff
=> cp.b 400000 fff80000 30000
=> cmp.b 400000 fff80000 30000
=> crc fff80000 30000
=> protect on fff80000 fffaffff
new firmware, uboot-v1.2-hack (the most mature i suggest)
brief about how to install on flash
=> printenv stdin=serial stdout=serial stderr=serial ... => setenv baudrate 9600 => setenv loads_echo 1 => ethaddr DE:AD:BE:EF:DE:AD => ethaddr serverip 192.168.1.14 => ethaddr ipaddr 192.168.1.2 => tftpboot 800000 uboot-v1.2.img TFTP from server 192.168.1.14; our IP address is 192.$ Filename 'uboot-v1.2.img'. Load address: 0x800000 Loading: *^H#########################################$ done Bytes transferred = 262144 (40000 hex) => crc 800000 40000 CRC32 for 00800000 ... 0083ffff ==> 3aae52fa => protect off fffc0000 ffffffff Un-Protected 4 sectors => erase fffc0000 ffffffff Erase Flash from 0xfffc0000 to 0xffffffff Erasing sector fffc0000 .Erasing sector fffd0000 .Erasing sector fffe0000 .Erasing sector ffff0000 . done Erased 4 sectors => cp.b 800000 fffc0000 40000 Copy to Flash... done => crc fffc0000 40000 CRC32 for fffc0000 ... ffffffff ==> 3aae52fa => protect on fffc0000 ffffffff => reset
brief about set baud and env
# setenv baudrate 9600 ## Switch baudrate to 9600 bps and press ENTER ... # saveenv Saving Environment to Flash... Un-Protected 1 sectors Un-Protected 1 sectors Erasing Flash... . done Erased 1 sectors Writing to Flash... done Protected 1 sectors Protected 1 sectors
download
crc (40000) = 3aae52fa
issues
...
uboot-2009 (not mature, not good, under development)
it's under development, it will released soon
status:
- uboot-1.2.0-hack-new: tftpboot is working with ramrootfs, ide is working
- uboot-2009: tftpboot is working with ramrootfs, ide is not working, eth0 issued, tftpboot issued with a download > 6Mb
uboot-kanojio
kernel>=2.6.25 requires ARCH=POWERPC, but they simply do not boot with uBoot: it seems the problem is that no "old-style" uImage is available for dht-walnut/walnut in unified powerpc source; it now requires the device tree.
From Documentation/powerpc/bootwrapper.txt: uImage: Native image format used by U-Boot. The uImage target does not add any boot code. It just wraps a compressed vmlinux in the uImage data structure. This image requires a version of U-Boot that is able to pass a device tree to the kernel at boot. If using an older version of U-Boot, then you need to use a cuImage instead.
There is no walnut cuImage(???), so the only choice is to use this "new-style" uImage and have uboot pass a walnut device-tree file to the kernel.
device-tree stuff is NOT supported with uboot, so ... you may use the new kanojio boot second stage loader
second stage kexec boot loader
uboot is the first stage bootloader, it's the first thing fetched by the cpu when you switch on the board.
the suggested (and hacked) uboot release is working fine, it's able to RAW read a PC partition from the hard drive putting the contents on the ram .. you could load a kernel from the HD and boot it.
it is also able to tftp a kernel from the net, but .. a bug is surviving from the 1.1.* release: this bug is limiting the amount of data you can tftp boot: 4.5Mb !
if your kernel+ramrootf is greater than 4.5Mb it will not be decompressed right cause of memory corruption (probably cause of a buffer overflow somewhere i dunno in the firmware)
so ! i developed a special second stage boot loader: it will be smaller than 4.5Mb and it will able to boot from net, pata, sata, scsi, firewire
and it should be able to read and boot all the binary format: elf, uImage, zImage, ecc
first shot, the proof of concept
[ .k.a.n.o.j.o. ] kexec boot loader v01.2, 2010-01-28 press a key to stop the autoboot process # cmdlist 231 help 230 cmdlist 252 ver 232 macaddr 233 tcpscan 234 ifconfig 235 endian 236 ttftp 240 exec 241 cmdline 237 env 237 printenv 238 saveenv 239 setenv 254 255 reboot 255 exit # help printenv show all the environment entries # printenv env.machinename="dht-walnut" env.root="/dev/hda3,ro" env.fstype="ext3" env.console="ttyS0,9600" env.net_dev="eth0" env.net_ip="192.168.1.11" env.net_mask="255.255.255.0" env.ttftp_server_ip="192.168.1.14" env.ttftp_server_port="2001" env.rmshell_port="2002" env.timeout="5s" env.boot="net" env.bootfile="dht-walnut--kernel-2.6.22-ramrootfs.img" env.net="ttftp $ttfpt_server_ip $ttftp_server_port $bootfile autoexec" # ttftp connect(): Connection refused, no ttftp server found # tcpscan $ttftp_server 1 2100 TCP port scanning connect_port={ 22 23 80 111 443 2000} # setenv ttftp_server_port 2000 # boot method=net downloading "dht-walnut--kernel-2.6.22-ramrootfs.img" from 192.168.1.14/2000 ... done kexec ... kernel loaded into ram ... jumping to it
i will release as soon as possible