Bootloader3 PDF
Bootloader3 PDF
October 2005
Documentation 3.0
1.0 Introduction
The Trizeps products are shipped as default with a firmware, which is able to main-
tain the hardware across the serial port, SD/MMC, CompactFlash and ethernet.
1 of 18
Keith & Koep GmbH Getting started
The bootstrap process will be interrupted, when more than one ESC character is
seen on COM1: during the initial bootphase. (FF Uart) @38Kb 8,n,1,noflow.
The contents of the file header describes what will be done with that file. The
header is described in chapter 7. There are following options possible:
1. Copy File to Memory and execute it.
2. Copy File to Memory and save this to flash. On the next bootphase without
SDMMC this file will be copied back to SDRAM and it will be executed
3. Show a Bitmap
4. Show a Bitmap and make it resident for the next start
5. Erase Registry
6. Erase Flashdisk
7. Write file to direct flash address. Using this you are able to
• Update Bootloader
• Update Flashdisk
• Update Registry
• Write OS Image (add. Boothdr required!)
Note: Don’t forget to remove the SD or MMC card after auto-update, or the same
update procedure will start over and over again.
4. Watch the output of the bootloader it will give you some bootloader information
and then a command line prompt.
5. Type ? <CR> to get a summary of all known commands.
6. Install the host components for bootloading via Ethernet
The target firmware supports download via bootp/tftp. Usually those services are
not available on Microsoft Windows operating systems. In this case you can use the
free bootp/tftp server programm from Cabletron.
1. Unpack ther boottft2.zip archive and install this to your PC. The standard instal-
lation path is c:\tftpboot.
2. Open the Cabletron program and then select BootP Server.
3. Enter mac <CR> <ESC> at your hyperterm window to see the mac address of
the board.
4. Fill in this mac address into the upper left field of the cabletron server program.
(Note: Cabletron wants ’-’ as a seperator ! )
5. Assign a free IP address for your target board into the 2nd field.
6. Enter the boot file name and path to the upper right field.
(Attention: DOS 8.3 filenames!)
Note:
Use ’-’ as seperator !
Now the bootloader issues a bootp request as a broadcast to the ethernet. The
request will be answered by the bootp server. The answer contains those parameters
needed for booting:
1. Target IP address
2. Netmask
3. Gateway IP address
4. Server IP address
5. Bootfilename
Having the bootp information the bootloader output shows this information to the
serial line and starts a tftp session to the given Server with the given filename.
The first 512 Bytes of the image file contain information like the load address and
flags telling the bootloader what to do with the file.
Having the transport finished, the image, which is downloaded is either started by
the bootloader or it is burned to flash. The burning algorithm only touches the mod-
ified flash sectors and it will do an erase cycle only if needed. During the flashing
process you will see a progressbar with characters walking from left to the right.
One for each sector:
• ’E’ for erase
• ’B’ for burn
• ’*’ modification done successfully
• ’-’ no modification needed for this sector
The bootfile which is loaded carries bootloader information in the first block. The
header is described in „Genboot Header“ at Page 14. of this document. This infor-
mation block describes where to load the image file in dram and wether is will be
burned to flash after download. A file without this header will not be fully trans-
ferred to target as the bootloader does not know what to do with it.
There is one utility called genboot (same as buildboot.exe) which may be used to
generate those 512 Byte headers, which may be pasted before the binary image.
Keith & Koep provides the sourcecode of genboot and some scripts to use this tool
to support the usual OS development tools like Linux, VxWorks, OS9, and Win-
dows CE.
The second mode is obtained without the WINCE option. Using this mode, the util-
ity ejects 512 Bytes to the standard output. This output may be redirected to a file,
which might be pasted with cat or copy to the start of the image file.
TABLE 1.
s
d
tf
/
d opt. t
m
p
m
c Download Type
-d0 * * (default) Transfer file to SDRAM and start it after download.
-d2 * * Load file to SDRAM and start a gdb session afterwards
(use a udp-based gdb protocol which is quite similar to the
remote serial target) This feature is only usable with seperate
support for the debugging of standalone programs.
-d3 * * Load file to SDRAM and copy this to the flash image area
later.
After the next power-up the bootloader may copy the flash
content back to SDRAM and start it as the default program or
OS.
TABLE 1.
s
d
tf
/
d opt. t
m
p
m
c Download Type
-d4 * Used to burn the given file to sector 0 of the flash. Note: If the
content of the file is wrong or if you power down the target
during the flashing process the target is lost until the boot-
loader is restored by a JTAG download process.
-d6 * (sdmmc only) Show Bitmap File. The Fileformat is shown in
-d7 * * Show and Bitmap File and burn this file to Flash
-d8 * * Download binary file to specified flash address
Mask Add Mask Below to add additional funktionality
+0x20 * Add 0x20 to arg to Proceed with next file. Do not enter com-
mand shell.
For bitmaps: Do not ask to confirm flashing of bitmap.
+0x40 * Add 0x40 to arg for erasing the IPSM Flashdisk during update
+0x80 * Add 0x80 to arg for erasing the persistant registry of wince
3.1.1 Example 1
Patch image file (using WINDOWS CE: usually nk.nb0) with the bootheader infor-
mation. Load image to SDRAM Address 0xA0080000 and start execution at
0xA0801000 after download. The filesize is recognized automatically and so build-
boot will place this information directly into the header.
Patch image file (using WINDOWS CE: usually nk.nb0) with the bootheader infor-
mation. Load image to SDRAM Address 0xA0080000 and burn this image to flash
as the standard bootfile. After next power up, the bootloader copies the file back to
SDRAM address 0xA0080000 and it will start at entry address 0xA0801000.
Note: load to SDRAM Address 0xA0080000 as the virtual SDRAM base address is
0x0 using cached and buffered access. Loading to 0x80000 instead to 0xA0080000
will speed up bootstrap performance significantly.
3.1.2 Example 2
Build a header of 512 bytes which let the bootstraploader load 0x1000 Bytes to
SDRAM address 0xA0A00000 (PXA250 SDRAM physical address) and jump to
address 0xA0A00020 after download. If you exchange -d0 with -d3 the image will
be downloaded and the given filesize (0x1000 Bytes) will be burned to flash. The
Flash address is the next free sector behind the bootloader. The bootloader generates
an own bootheader which makes it possible to copy the given filesize of the flash
content back to the specified SDRAM address after powerup.
This kind of invokement may be used if you want to use a compressed image. You
should compress your image with gzip -9 imagefile before. The bootloader test the
first word of the image against the gzip MAGIC word and is able to decompress the
image as soon as it is burned to flash.
3.2 Example 3
windows:
buildboot -d8 0xA0800000 1 0x60000 0x100000 >headerfile
copy /b headerfile + imagefile bootfile
unix script:
#!bin/sh
imagefile=$1
filelen=`ls -l $imagefile | awk '{ print $4 }'`
buildboot -d8 0xA0800000 1 0x60000 $filelen | cat - $imagefile >bootfile
This commands generate a bootfile which lets the bootloader load the imagefile to
FLASH address 0x60000. The bootloader uses the SDRAM scratchbuffer at
address 0xA0800000. This feature may be used to bring up a file system image to a
defined place in flash, e.g. IPSM or Linux compressed ramdisk images.
Note: As this is a direct flash load, no additional headers are generated. Without a
header at the first sector behind the bootloaders (usually at 0x60000), the bootloader
is not able to start a program.
3.3 Example 4:
Even if the boottime is relatively short, some customers want to show a splash
screen during the bootstrap phase. For this purpose you can download a file together
with a display description. This file can be loaded from SDMMC or from the inter-
nal flash. The example describes the case, that you want to load a bitmap into the
internal flash.
bitmapboot generates a file which is burned to flash. (uses -d7 option of buildboot).
Sx14.dis is a description file which describes the display timing to the bootloader.
Oembitmap256.bmp is a bitmap file with 256 Colors, not compressed. Bootfile
specifies the output filename which can be booted via TFTP or sdmmc (auto-
boot.001).
Having an image loaded to flash, the bootloader is able to show this bitmap during
the bootstrap process.
The Keith & Koep bootloader image consists of two packages: PBL and SBL. The
PBL (Primary Boot Loader) is a very small piece of code, which is useful to encap-
sulate the memory initialization procedure and the powermanagement hooks needed
for resuming the execution after sleep. It is a completly independent package, which
is hooked to the main bootloader (SBL - Secondary Boot Loader) by a USRBOOT
header.
At reset the processor begins executing at Addr 0 with flash mapped to Addr 0. The
first code (PBL) initializes the memory interfaces and looks for a USRBOOT
header at Addr 0x4000. This address lies outside of the standard bootloader image.
If the PBL will find a valid bootheader there, it copies the specified portion of flash
to SDRAM and starts the execution as specified. If the USRBOOT header at this
location is invalid, PBL tries to start the default image which is inside the current
bootloader image.
Using Trizeps1, the bootloader is stored twice. In this case the PBL always tries to
run the copy of the real code. If the copy is missing it runs the original code. But
this code just looks for the copy. If it finds no copy it makes a copy and stops execu-
tion. So it is possible to develop code changes to the PBL quickly as you have to
burn only some kilobytes of code via jtag.
The TRIZEPS2 and TRIZEPS3 bootloaders still have the possiblity to run with a
copy but the factory default has been changed to use only one bootloader making
the update as simple as possible. So using TRIZEPS2 or TRIZEPS3 you only have
to download the update. No other interaction is needed.
Using Trizeps1:
Trizeps2: Newer versions are able to remap the bootloader code to another physical
address. So if the SDRAM part of the bootloader and the code to be boot would
overlap, the bootloader moves it’s physical position, remap the code and copy the
bootcode into the right pyhsical position. Make sure that all references in your boot-
header are made to physical addresses if you want to use this feature.
Trizeps4: The Trizeps4 bootloader only uses a PBL and one SBL. On startup the
PBL copies the SBL to the internal SRAM of the PXA270-processor, making it
completly independent from externel SDRAM. To update your Bootloader for
Trizeps4 use:
• xscale.tft for 520MHz-modules (standard).
• xscale416.tft for 416MHz-modules.
• xscale312.tft for 312MHz-modules.
You may also use the 312 and 416MHz bootloaders, if you would like to evaluate
wether you can switch from the 520MHz-module to the cheaper modules. Note: you
should not use a higher-MHz-bootloader for modules with lower frequency!!
TABLE 2.
7.0 HEADER
} USRBOOT, *P_USRBOOT;
7.2 Boot_hdr
This header is used by the bootp/tftp bootloader. It is responsible to boot an Operat-
ing System or user program. The header is validated by a magic word which may be
either FLASH_MAGIC (0x31415926) to identify a program to be booted or a
BITMAP_MAGIC to identify a splash screen which is shown during boot. In case
of a BITMAP_MAGIC the next header will be followed [len] bytes behind this
header.
#define FLASH_MAGIC 0x31415926
#define BITMAP_MAGIC 0x31415927
struct boot_hdr
{
struct boot_hdr *next; // Sequence some files currently unused
unsigned long magic; // FLASH_MAGIC, BITMAP_MAGIC
unsigned long *dst; // copy to dest
unsigned long len; // image size to be copied to dest
void (*entry)(); // entry Address
unsigned long data[1]; // placeholder for bootdata, image begins here....
};
union bootblock {
char buffer[512];
struct arnold_bootheader boot;
};
struct segment { void *base; long len; }; //len MUST be Multiple of 512
} DISPLAY_INF, *PDISPLAY_INF;
//DisplayOn Bits:
//Set those bits in DisplayOn Variable to reach
//some extras which are not described through
//DISPLAY_INF.
//e.g. If DisplayOn is set to 0x80000000
//Wince takes display params from Bootloader.
This shows a reduced list of common bootloader commands. The bootloader is con-
tinual beeing enhanced with new features. To view all supported commands type
„?“ at the bootloader prompt.
command description
adc Get analog to digital conversion values
from on-board Codec.
baud <baudrate> set baudrate of com1: (default is 38400).
beep <volume> <time> <count> beep.
cb <address> <value> change byte (8bit write)
cw <address> <value> change word (16bit write)
cl <address> <value> change long (32bit write)
cisdump dump pcmcia card information structure.
contr <+/- steps> adjust value of contrast eepot.
backlight <+/- steps> adjust value of brightness eepot.
dump <address> <count> dump bytes (8bit reads)
dumpw <address> <count> dump shorts (16bits reads)
dumpl <address> <count> dump longs (32bits reads)
eflashb0 erase flash (, without bootloader)
epsm erase IPSM-part of flash (flashdisk under
WinCE)
ereg erase registry (WinCE)
fb flash boot. Boot image stored in flash.
fuselist list availlable fuses. Fuses allow to change
the behaviour of the bootloader. Once bur-
ned, you need to reprogram the bootloader
to reset them.
fuseburn burn a fuse.
i2cread <address> <subadr> read one byte from i2c.
i2cwrite <address> <sub- write one byte to i2c.
adr><value>
jump <address> start executing code at this address.
tftp get image via bootp/tftp.
touch test touch.
reset generate soft reset.
srtc set RealTimeClock (PCF8593).
rtc print time from RTC.
00000000 64 6b 64 6a 66 69 76 6c 64 6c f6 73 6b 64 69 64 dkdjfivldl.skdid
• Set address to 0x58 (Note: Shift address 1bit left) and subaddress to 2:
:) set 0 0x58
Will set 0 to 0x58 on device i2c.
:) set 1 0x2
Will set 1 to 0x2 on device i2c.
• Verify parameters:
:) help ARGUMENT MISSING ! DEFAULT ARG: 0
Following values can be set for interface i2c
[0] SlaveAddress is 0x00000058 (0)
[1] SubAddress is 0x00000002 (0)
• Initialize i2c-interface:
:) open i2c