Direct FLASH Programming

The following instructions describe how to install RedBoot by programming the FLASH directly from the JTAG debugger. At present this has only been tried using an Abatron BDI2000 debugger and these instruction apply to that device. However, it should be possible to adapt these instructions to any other device.

The BDI2000 configuration file needs to be set up to initialize the SDRAM and to tell it what type of FLASH device is present. The resulting config file is shown below:

; bdiGDB configuration for Motorola M9328MX1ADS board
; ---------------------------------------------------
;
[INIT]
;Init SDRAM 16Mx16x2 IAM0 CS2 CL2
;
WM32    0x00221000  0x92120200  ;Set Precharge Command
WM32    0x08200000  0x00000000  ;Issue Precharge all Command
WM32    0x00221000  0xa2120200  ;Set AutoRefresh Command
WM32    0x08000000  0x00000000  ;Issue AutoRefresh Command
WM32    0x08000000  0x00000000
WM32    0x08000000  0x00000000
WM32    0x08000000  0x00000000
WM32    0x08000000  0x00000000
WM32    0x08000000  0x00000000
WM32    0x08000000  0x00000000
WM32    0x08000000  0x00000000
WM32    0x00221000  0xb2120200  ;Set Mode Register
WM32    0x08111800  0x00000000  ;Issue Mode Register Command, Burst Length = 8
WM32    0x00221000  0x82124200  ;Set to Normal Mode
;

[TARGET]
CPUTYPE     ARM920T
CLOCK       1                   ;JTAG clock (0=Adaptive, 1=8MHz, 2=4MHz, 3=2MHz)
WAKEUP      3000                ;because of slow rising reset line
RESET       HARD 1000           ;because of heavy capacitive load on reset line
ENDIAN      LITTLE              ;memory model (LITTLE | BIG)
BREAKMODE   HARD
VECTOR      CATCH 0x1f          ;catch D_Abort, P_Abort, SWI, Undef and Reset

[HOST]

[FLASH]
; Program RedBoot with:
; Core#0> erase
; Core#0> prog 0x10000000 MX1 BIN
WORKSPACE   0x08000000
CHIPTYPE    AM29DX32
CHIPSIZE    0x01000000
BUSWIDTH    32
ERASE       0x10000000
ERASE       0x10004000
ERASE       0x10008000
ERASE       0x1000c000
ERASE       0x10010000
ERASE       0x10014000
ERASE       0x10018000
ERASE       0x1001c000
ERASE       0x10020000


[REGS]
FILE    regMX1.def

The BDI2000 needs to be rebooted to cause it to reload this configuration file. Once this is done connect to the BDI2000 via its telnet port and issue a reset command:

Core#0>reset
- TARGET: processing reset request
- TARGET: BDI asserts TRST and RESET
- TARGET: BDI removes TRST
- TARGET: Bypass check 0x000000001 => 0x00000001
- TARGET: JTAG exists check passed
- Core#0: ID code is 0x1092001D
- TARGET: All ICEBreaker access checks passed
- TARGET: BDI removes RESET
- TARGET: BDI waits for RESET inactive
- TARGET: resetting target passed
- TARGET: processing target startup ....
- TARGET: processing target startup passed
Core#0>

Now ensure that the FLASH is erased. The following command uses the ERASE entries in the configuration file to erase the first 9 blocks in the FLASH.

Core#0>erase
Erasing flash at 0x10000000
Erasing flash at 0x10004000
Erasing flash at 0x10008000
Erasing flash at 0x1000c000
Erasing flash at 0x10010000
Erasing flash at 0x10014000
Erasing flash at 0x10018000
Erasing flash at 0x1001c000
Erasing flash at 0x10020000
Erasing flash passed
Core#0>

Copy redboot_ROMRAM.bin to the root directory of the same TFTP server used to fetch the configuration file and execute the following command:

Core#0>prog 0x10000000 redboot_ROMRAM.bin bin
Programming redboot_ROMRAM.bin , please wait ....
Programming flash passed
Core#0>

If this completes successfully then the FLASH has been programmed. You can start RedBoot by issuing the go command, or by detaching the BDI2000 and cycling the power switch of the board. You should see the RedBoot startup screen:

+... waiting for BOOTP information
Ethernet eth0: MAC address 0e:00:00:ea:18:f0
IP: 10.0.0.207/255.255.255.0, Gateway: 10.0.0.3
Default server: 10.0.0.1, DNS server IP: 10.0.0.1

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version UNKNOWN - built 15:51:18, Jul 19 2004

Platform: Motorola MX1ADS/A (ARM9)
Copyright (C) 2000, 2001, 2002, Free Software Foundation, Inc.
Copyright (C) 2003, 2004, eCosCentric Limited

RAM: 0x00000000-0x02000000, [0x0002f778-0x01fdd000] available
FLASH: 0x10000000 - 0x12000000, 256 blocks of 0x00020000 bytes each.
RedBoot>

Download RedBoot

The following instructions describe how to install RedBoot via the JTAG interface by downloading a version of RedBoot to program the FLASH. This is a two stage process, you must first download a RAM-resident version of RedBoot and then use that to download the ROM image to be programmed into the flash memory. The following directions are necessarily somewhat general since the specifics depend on the exact JTAG device available, and the software used to drive it.

Connect the JTAG device to the JTAG connector on the MX1ADS/A board and check that the device is functioning correctly. Using 32 bit memory writes, initialize the static memory controller so that the SDRAM and flash are accessible. The following assignments should be made:

*(long *)0x00221000 = 0x92120200;  // Set Precharge Command
*(long *)0x08200000 = 0x00000000;  // Issue Precharge all Command
*(long *)0x00221000 = 0xa2120200;  // Set AutoRefresh Command
*(long *)0x08000000 = 0x00000000;  // Issue AutoRefresh Command
*(long *)0x08000000 = 0x00000000;
*(long *)0x08000000 = 0x00000000;
*(long *)0x08000000 = 0x00000000;
*(long *)0x08000000 = 0x00000000;
*(long *)0x08000000 = 0x00000000;
*(long *)0x08000000 = 0x00000000;
*(long *)0x08000000 = 0x00000000;
*(long *)0x00221000 = 0xb2120200;  // Set Mode Register
*(long *)0x08111800 = 0x00000000;  // Issue Mode Register Command, Burst Length = 8
*(long *)0x00221000 = 0x82124200;  // Set to Normal Mode

Now load the SRAM redboot binary image from the file redboot_SRAM.bin into SDRAM at 0x08040000. Exactly how you do this depends on the JTAG driver software. Note that it may be easier to load the ELF or SREC files, if supported, since these contain the correct load addresses.

Connect the serial port of a host machine to UART 1 on the MX1ADS/A board and start a terminal emulator (for example HyperTerminal on Windows, minicom on Linux) set up to communicate at 38400 baud, 8 bits, one stop bit, no parity. Start RedBoot by executing from location 0x08040000, which should result in RedBoot starting up and emitting this message on the serial channel:

+... waiting for BOOTP information
Ethernet eth0: MAC address 0e:00:00:ea:18:f0
IP: 10.0.0.207/255.255.255.0, Gateway: 10.0.0.3
Default server: 10.0.0.1, DNS server IP: 10.0.0.1

RedBoot(tm) bootstrap and debug environment [SRAM]
Non-certified release, version UNKNOWN - built 15:50:10, Jul 19 2004

Platform: Motorola MX1ADS/A (ARM9)
Copyright (C) 2000, 2001, 2002, Free Software Foundation, Inc.
Copyright (C) 2003, 2004, eCosCentric Limited

RAM: 0x08000000-0x0c000000, [0x08065ea0-0x0bfdd000] available
FLASH: 0x10000000 - 0x12000000, 256 blocks of 0x00020000 bytes each.
RedBoot>

Now the ROM image can be downloaded using the following RedBoot command:

RedBoot> load -r -b %{FREEMEMLO} -m ymodem

Use the terminal emulator's Ymodem support to send the file redboot_ROMRAM.bin. This should result in something like the following output:

Raw file loaded 0x08066000-0x080b900d, assumed entry at 0x08066000
xyzModem - CRC mode, 2659(SOH)/0(STX)/0(CAN) packets, 5 retries
RedBoot>

Once the file has been uploaded, you can check that it has been transferred correctly using the cksum command. On the host (Linux or Cygwin) run the cksum program on the binary file:

$ cksum redboot_ROMRAM.bin
3848755608 118224 redboot_ROMRAM.bin

In RedBoot, run the cksum command on the data that has just been loaded:

RedBoot> cksum -b %{FREEMEMLO} -l 118224
POSIX cksum = 3848755608 118224 (0xe5675998 0x0001cdd0)

The second number in the output of the host cksum program is the file size, which should be used as the argument to the -l option in the RedBoot cksum command. The first numbers in each instance are the checksums, which should be equal.

If the program has downloaded successfully, then it can be programmed into the flash using the following commands:

RedBoot> fis init
About to initialize [format] FLASH image system - continue (y/n)?y
*** Initialize FLASH Image System
... Erase from 0x11fe0000-0x12000000: .
... Program from 0x0bfe0000-0x0c000000 at 0x11fe0000: .
RedBoot> fis create -b %{FREEMEMLO} RedBoot
An image named 'RedBoot' exists - continue (y/n)?y
... Erase from 0x10000000-0x10020000: .
... Program from 0x08066000-0x08086000 at 0x10000000: .
... Erase from 0x11fe0000-0x12000000: .
... Program from 0x0bfe0000-0x0c000000 at 0x11fe0000: .
RedBoot>

The MX1ADS/A board may now be disconnected from the JTAG device and reset by cycling the power. It should then display the startup screen for the ROMRAM version of RedBoot:

+... waiting for BOOTP information
Ethernet eth0: MAC address 0e:00:00:ea:18:f0
IP: 10.0.0.207/255.255.255.0, Gateway: 10.0.0.3
Default server: 10.0.0.1, DNS server IP: 10.0.0.1

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version UNKNOWN - built 15:51:18, Jul 19 2004

Platform: Motorola MX1ADS/A (ARM9)
Copyright (C) 2000, 2001, 2002, Free Software Foundation, Inc.
Copyright (C) 2003, 2004, eCosCentric Limited

RAM: 0x00000000-0x02000000, [0x0002f778-0x01fdd000] available
FLASH: 0x10000000 - 0x12000000, 256 blocks of 0x00020000 bytes each.
RedBoot>