Fab4 Kernel Notes
From SqueezeboxWiki
Contents |
Fab4 Board
Board revisions (see /proc/cpuinfo revision) :
Board | CPU | Revision | Notes |
---|---|---|---|
PA1 | i.MX35 TO1 | 1 | |
PA2 | i.MX35 TO1 | 2 | |
PA3/PB1 | i.MX35 TO1 | 3 | |
PA3/PB1 | i.MX35 TO2 | 4 |
The following components are software controlled, and kernel drivers are needed to support them.
Function | Component | Notes |
---|---|---|
CPU | Freescale i.MX35 | |
NAND Flash | |
|
LCD | Wintek WD-F4827VN-6FLWa (production) Sharp LQ043T3DX04 (early prototype) |
Wintek requires some programming through SPI |
Wlan | Marvel 8686 | |
Codec1 | AK4420ETP | |
Codec2 | WM8974GEFL | |
Temperature sensor | TMP100 | |
Ambient light sensor | TSL2569 | |
secondary MCU for IR | CY8C21323 (256B/4kB) |
GPIO assignment iMX35
To avoid undesirable glitches on output lines during boot, the level should be set first and then the direction is changed from input to output.
Signal name | iMX35 pin | Mode | Port | Direction | Notes |
---|---|---|---|---|---|
FAIL_SAFE# | FST/GPIO1_8 | ALT5 | GPIO1_8 | INPUT | Active low while the reset button is pressed |
SD_CD# | ATA_CS0/GPIO2_6 | ALT5 | GPIO2_6 | INPUT (maybe IRQ?) | Check for driver hooks (RT). SD-Card detection (low = card detected) |
SD_WP# | ATA_DMARQ/GPIO2_31 | ALT5 | GPIO2_31 | INPUT | Check for driver hooks (RT). SD-Card write protection (low = write protection) |
I2C_ATTN1# | I2C2_CLK/GPIO2_26 | ALT5 | GPIO2_26 | INPUT (IRQ) | on 3-stack (touch panel interrupt GPIO1_4) (low = touchpanel requires attention) |
I2C_ATTN2# | I2C2_DAT/GPIO2_27 | ALT5 | GPIO2_27 | INPUT (IRQ) | IR MCU interrupt (low = MCU requires attention) |
IR_SENSOR# | CAPTURE/GPIO1_4 | ALT0 | CAPIN1 | INPUT | (low = IR @ 38kHz detected) |
IR_LED | GPIO1_1/PWMO | ALT2 | PWMO | INPUT if IR LED controlled by CY8C21323 or OUTPUT if IR LED controlled by iMX35 | |
OSC_SEL2 | TX5_RX0/GPIO1_10 | ALT5 | GPIO1_10 | OUTPUT (low) | 88.2/96 Select for AK4420 (low = 88.2, high = 96) |
OSC_SEL1 | TX4_RX1/GPIO1_11 | ALT5 | GPIO1_11 | OUTPUT (low) | 88.2/96 Select for WM8974 (low = 88.2, high = 96) |
HDP_EN | ATA_RESET#/GPIO2_11 | ALT5 | GPIO2_11 | OUTPUT (low) | Headphone enable (low = Geek Hole, high = Headphone) |
USB_HOST_EN# | USBOTG_PWR/GPIO3_14 | ALT 0 | USBOTG_PWR | OUTPUT (high) | Check for driver hooks(RT). Control power to the USB port (low = USB port enable; high USB port disabled) |
USB_HOST_OC# | USBOTG_OC/GPIO3_15 | ALT 0 | USBOTG_OC | INPUT | Check for driver hooks(RT). Over-current detection on the USB port (low = OC detected; high = normal) |
LCD_DISP | D3_SPL/GPIO1_5 | ALT5 | GPIO1_5 | OUTPUT (low) | needs to be driven from low to high once after init lcd (VSYNC must be running) |
LED_PWM | CONTRAST/GPIO1_1 | ALT0 | DISPB_CONTR | OUTPUT (low) | |
HDP_DET | ATA_DIOW/GPIO2_9 | ALT5 | GPIO2_9 | INPUT (IRQ?) | low = 3.5mm jack not plugged, high = 3.5mm jack plugged |
WIFI_PD# | ATA_DIOR/GPIO2_8 | ALT5 | GPIO2_8 | OUTPUT (high) | WLAN Power (low = power-down mode) |
WIFI_RESET# | ATA_CS1/GPIO2_7 | ALT5 | GPIO2_7 | OUTPUT (low) | WLAN RESET#, needs to be driven from low to high once after power on reset and possibly each time WIFI_PD# goes active low |
DAC1_SMUTE | ATA_INTRQ/GPIO2_29 | ALT5 | GPIO2_29 | OUTPUT (low) | (low = not muted; high = muted) |
IR_XRES | ATA_DA2/GPIO3_2 | ALT5 | GPIO3_2 | INPUT (100k pull-down) | IR MCU reset; used to re-flash CY8C21323 (new on PA3) |
IR_XSCL | ATA_DA0/GPIO3_0 | ALT5 | GPIO3_0 | INPUT (100k pull-down) | IR MCU ISSP clock line; used to re-flash CY8C21323 (new on PA3) |
IR_XSDA | ATA_DA1/GPIO3_1 | ALT5 | GPIO3_1 | INPUT (100k pull-down) | IR MCU ISSP data line; used to re-flash CY8C21323 (new on PA3) |
RESERVED (IR_BLASTER_EN) | ATA_DMACK/GPIO2_10 | ALT5 | GPIO2_10 | INPUT (no pull-up/down and no keeper) | Enable the logic to blast IR through the geek hole when HDP_EN is inactive (new on PA3) |
I2C addresses
device | 7-bit addresss | 400kHz capable |
---|---|---|
TMP100 | 0x48 | yes |
TSL2569 | 0x39 | yes |
CY8C21323 | 0x47 | yes |
WM8974 | 0x1a (on PA3) | yes |
SPI addresses
device | chip select |
---|---|
WM8974 | SPI1_SS0# (on PA2) |
LCD | SPI1_SS1# |
Programming the Wintek LCD
The following stream of 16bits words needs to be send:
0x0020, 0x041f. No programming required.
The format is:
D[15..10] | address |
D[9] | 0: write 1: read |
D[8] | guard bit for HiZ transition when reading |
D[7..0] | data to be written |
CY8C21323 (IR MCU)
Resetting the CY8C21323 (IR MCU)
The CY8C21323 should be reset by iMX35 through pin IR_XRES when the OS is booting. To reset the IR MCU, set the GPIO to output high for 1ms and set it back to input again while keeping the 100k pull-down enabled.
Flashing the CY8C21323 (IR MCU)
The CY8C21323 can be re-flashed through the ISSP (In-System Serial Program) pins by using the Reset Mode explained in the application note AN2026a. http://download.cypress.com.edgesuite.net/design_resources/application_notes/contents/in_system_serial_programming__issp__protocol_for_cy8c21xxx_cy8c22xxx_cy8c24xxx_cy8c24xxxa_cy8c27xxx___an2026a_12.pdf
DDR2
From Freescale iMX35 Errata 4 June 2008:
The EMI hangs up when the ARM Platform accesses certain DDR2 addresses in burst mode: - External 16bit DDR2 memory: o INCRx. o WRAPx. o Address ending 0x4 and 0xC. - External 32bit DDR2 memory: o INCRx. o WRAPx. o Address ending 0x8. All other AHB Masters, besides ARM Platform, won’t cause this problem. Impact: EMI locks. No instruction execution, no debug break. Need system reset to recover. Workaround: - The 16 bit mode has no workaround. - On 32 bit mode, by writing bit12 of L2CCAUX register, there will be no WRAPx burst from ARMP. And INCRx from ARMP will not be with start address ending 0x8. Thus there is no hang up. - Use Mobile DDR.
The L2CCAUXCR is described in Section 17.3.3.
SPDIF clock
The magic search keyword is 'osc_audio'. This signal comes from audio xtal as shown in Figure 5-2. The clock tree is "shown" in Figure 5-10. Also take a look at 'osc_audio' in figure 61-2.
System Boot
The mx35 supports several boot modes:
- External Boot (BMOD[1..0] = 10)
- This is the boot mode configured on the PA1 boards. Section 7 is a little light on details "MXIMX35 supports direct boot from NAND flash".
- This is the mode supported by Redboot/Linux on the 3-stack.
- Booting from NAND flash is described in more detail in Section 29.9.2.
- bootloader copies 4 pages (from 1/2KB flash) into NFC internal RAM buffer.
- EEC is used, always calculated on 1/2KB data. So if 2k or 4k page flash is used then it gets complicated :).
- Internal Boot (BMOD[1..0] = 00)
- This mode will try to boot from NAND flash, and if that fails will allow booting from usb/serial as a backup.
- The first block of the flash needs to be duplicated (in case the first block is bad).
- 4-bit or 8-bit EEC is used when loading from the flash.
- A flash header is needed in front of the bootloader, this includes a magic barker code and code signatures for the boot code.
So do we really need the USB/Serial backup for flashing the boards? If we do it means modifying the bootloader build to add the flash header.
Using the internal mode allows the first block of flash to be bad. This should not be a problem as the flash is fully guaranteed that the 1st block is valid and it does not require ECC.
Redboot
Redboot is extended to support the Fab4 board in packages/hal/arm/mx35/fab4. This is initially a clone of the mx35-3stack board, with the following changes:
- Update board and machine type (in hal_arm_board.cdl). A new machine type is registered for Fab4, see http://www.arm.linux.org.uk/developer/machines/?action=list&id=1804.
- Use 128M DDR2 memory.
- Removed references to the PMIC chip, and related chip select pins.
- Removed flashing debug LED in the redboot idle loop.
- Added support for the physical reset button to halt the boot script.
- Added support for UBI (includes minor changes to the mxc_nfc to report bad blocks).
- Allow default values for boot_script_* to be compiled in.
- Allow default values for FEC to be compiled in.
Useful references in the code:
- packages/hal/arm/arch/current/src/vectors.S
- ARM exception vectors
- reset_vector, calls PLATFORM_SETUP1 out of reset for board configuration (see below).
- other non-platform init code, and jumps to eCos kernel.
- packages/hal/arm/mx35/fab4/include/hal_platform_setup.h
- Initial assembler setup including
- ARM1136 init
- L2 cache setup
- aips
- max
- m3if
- clocks
- sdram (in our case ddr2)
- copy image from flash (config the nand flash controller, bad block handling is commented out). an alternative CYG_HAL_STARTUP_ROMRAM may be used on our platform. [RT - check this]
- c-stack
- mmu
See this analysis Fab4 Bootloader Init.
In redboot.elf most of the code starts from 0x00008000. The exception vectors and platform setup is compiled to 0x87f00000.
- packages/hal/arm/mx35/fab4/current/include/pkgconf/mlt_arm_board_romram.lid
- Linker file, this sets the ROM address to start at 0x87f00000.
- packages/hal/arm/arch/current/src/redboot_linux_exec.c
- do_exec() is the code that boots linux after setting up the tag param block.
- * How does the initial boot loader code get put in the first flash block, and how big is it * *
Flash partition table
The following partition table will be used initially for the PA1 prototypes:
i.MX35 3-stack
Partition Erase Blocks Start Block Start Address Length redboot 1 0 0x00000000 0x00040000 kernel 8 1 0x00040000 0x00200000 kernel 8 9 0x00240000 0x00200000 cramfs 80 17 0x00440000 0x01400000 cramfs 80 97 0x01840000 0x01400000 yaffs 80 177 0x02C40000 0x01400000 *spare* 7929 257 0x04040000 0x7be40000 redboot config 1 8186 0x7FE80000 0x00040000 FIS directory 1 8187 0x7FEC0000 0x00040000 Linux BBT 4 8188 0x7FF00000 0x00100000 End 8192 0x80000000
PA1
Partition Erase Blocks Start Block Start Address Length redboot 16 0 0x00000000 0x00040000 kernel 116 16 0x00040000 0x001D0000 kernel 116 132 0x00210000 0x001D0000 cramfs 1280 248 0x003E0000 0x01400000 cramfs 1280 1528 0x017E0000 0x01400000 yaffs 1282 2808 0x02BE0000 0x01408000 redboot config 1 4090 0x03FE8000 0x00004000 FIS directory 1 4091 0x03FEC000 0x00004000 Linux BBT 4 4092 0x03FF0000 0x00010000 End 4096 0x04000000
UBI/UBIFS
The following partition table will be used after conversion from cramfs/yaffs to ubi/ubifs.
Partition Erase Blocks Start Block Start Address Length redboot 16 0 0x00000000 0x00040000 kernel 116 16 0x00040000 0x001D0000 kernel 116 132 0x00210000 0x001D0000 ubi 3842 248 0x003E0000 0x03C08000 redboot config 1 4090 0x03FE8000 0x00004000 FIS directory 1 4091 0x03FEC000 0x00004000 Linux BBT 4 4092 0x03FF0000 0x00010000 End 4096 0x04000000
Building Redboot
Redboot it not yet included in the SqueezeOS build process. Use the following instructions to build redboot.
- First checkout the bootloader from "https://svn.slimdevices.com/repos/jive/7.4/private-branches/fab4/bootloaders/imx35"
- Configure your environment (assumes the bootloader is checed out in imx35-bootloader):
export PATH=~/imx35-bootloader/gnutools/arm-elf/bin/:~/imx35-bootloader/bin/:$PATH export ECOS_REPOSITORY=~/imx35-bootloader/imx35/ecos_20050912/packages/
- Configure the build:
mkdir ecos-build cd ecos-build ecosconfig new mx35_fab4 redboot ecosconfig import $ECOS_REPOSITORY/hal/arm/mx35/fab4/current/misc/redboot_ROMRAM.ecm ecosconfig import $ECOS_REPOSITORY/hal/arm/mx35/fab4/current/misc/redboot_fab4.ecm ecosconfig add UBI ecosconfig tree
- Make the build
make
- The redboot image is in install/bin/redboot.bin
Redboot Commands
Original fconfig from Freescale
RedBoot> fconfig -n -l boot_script: true boot_script_data: .. fis load kernel .. exec -c "noinitrd console=ttymxc0,115200 root=/dev/mtdblock8 rw rootfstype=cramfs" boot_script_timeout: 1 bootp: true bootp_server_ip: 192.168.1.79 brd_specs: 0 console_baud_rate: 115200 eth0_esa: false fec_esa: false gdb_port: 9000 info_console_force: false net_debug: false net_device: mxc_fec
Initialize flash
Note: redboot already needs to be written to the flash starting in block 0.
Note: the following commands use the 3-stack addresses and need converting for the smaller flash chips.
Initialize configuration:
RedBoot> fconfig -i Initialize non-volatile configuration - continue (y/n)? y Run script at boot: true Boot script: Enter script, terminate with empty line >> fis load kernel >> exec -c "noinitrd console=ttymxc0,115200 root=/dev/mtdblock2 ro rootfstype=cramfs init=/linuxrc" >> Boot script timeout (1000ms resolution): 1 Use BOOTP for network configuration: true Default server IP address: 192.168.1.79 Board specifics: 0 Console baud rate: 115200 Set eth0 network hardware address [MAC]: false Set FEC network hardware address [MAC]: false GDB connection port: 9000 Force console for special debug messages: false Network debug at boot time: false Default network device: mxc_fec Update RedBoot non-volatile configuration - continue (y/n)? y ... Erase from 0x7fe80000-0x7fe81000: . ... Program from 0x07eb3000-0x07eb4000 at 0x7fe80000: .
Initialize filesystem:
fis init -i
# kernel load -v -r -b 0x100000 zImage fis create -l 0x00200000 -f 0x00040000 kernel
# cramfs load -v -r -b 0x100000 root.cramfs fis create -l 0x01400000 -f 0x00440000 root
# jffs2 fis create -n -l 0x01400000 -f 0x02C40000 jffs2
# spare (on 3-stack only) fis create -n -l 0x7BE40000 -f 0x04040000 spare
Upgrade redboot
load -v -r -b 0x100000 redboot.bin run # this runs the new image, test it works then: romupdate
Upgrade kernel
load -v -r -b 0x100000 zImage fis create kernel
Upgrade root filesystem
load -v -r -b 0x100000 root.cramfs fis create root
Redboot and JTAG
The initial bootloader code is in hal_platform_setup.h. This initialized the ARM core, DDR2 memory and loads Redboot from flash.
When the mx35 is powered on the first two pages of flash are loaded in to the NFC (nand flash controller) buffer at 0xbb000000. When the boot switches are set to "external boot" the code is normally executed from this buffer.
While using jtag it is useful to set the boot switch to "no boot" (11). Then to execute this code from peedi use:
set pc 0xbb000000 go
Other code can be loaded into this flash buffer, but first it must be unlocked. For example to load init.bin (the first 2k of the bootloader) use:
memory write16 0xbb001e0a 0x02 memory load tftp://192.168.1.1/init.bin 0xbb000000
To boot without using the flash use:
memory write 16 0xbb001e0a 0x02 memory load tftp://192.168.1.1/init.bin 0xbb000000 set pc 0xbb000000 breakpoint add hard 0xbb00047c go wait 500 memory load tftp://192.168.1.1./redboot.bin 0x87f00000 set pc 0x87f00714 go
Where the address are (use objdump to look these up from redboot.elf):
0xbb00047c HWInitialize_skip_SDRAM_setup 0x87f00714 HWInitialize_skip_SDRAM_copy
You can debug Redboot using the arm-elf-gdb from the ecos toolchain. To do this first initialize the DDR2 memory using (this example runs from flash):
set pc 0xbb000000 breakpoint add hard 0xbb00047c go
Then in gdb use:
target remote 172.19.114.50:2000 load set $pc=0x87f00714 c
You can use breakpoints, etc. in gdb as normal.
Linux Kernel
When it dosen't boot
Ok, so you've got as far as:
Uncompressing Linux............................................................................................... done, booting the kernel.
Then what? Well you can inspect the buffered printk() boot messages via jtag. First you need to find the address of the log buffer:
$ grep __log_buf System.map c02e7820 b __log_buf
Then using the jtag look at the messages:
fab4> mem read$ 0xc02e7820 0xC02E7820: <5>Linux version 2.6.24-186-g43e77a6 (richard@richard-desktop) (gcc version 4.2.3) #1 PREEMPT Wed Sep 3 21:30:34 BST 2008\n<4>CPU: ARMv6-compatible processor [4117b363] revision 3 (ARMv6TEJ), cr=00c5387f\n<4>Machine: Logitech Fab4 Board\n<4>Memory policy: ECC disabled, Data cache writeback\n<7>On node 0 totalpages: 32768\n<7> DMA zone: 48 pages used for memmap\n<7> DMA zone: 0 pages reserved\n<7> DMA zone: 6096 pages, LIFO batch:0\n<7> Normal zone: 208 pages used for memmap\n<7> Normal zone: 26416 pages, LIFO batch:7\n<7> Movable zone: 0 pages used for memmap\n<4>CPU0: D VIPT write-back cache\n<4>CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets\n<4>CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets\n<4>Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512\n<5>Kernel command line: noinitrd console=ttymxc0,9600\n<6>MXC IRQ initialized\n<4>PID hash table entries: 512 (order: 9, 2048 bytes)\n<6>MXC GPT timer initialized, rate = 16625000\n<4>Console: colour dummy device 80x30\n<6>Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)\n<6>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)\n<6>Memory: 128MB = 128MB total\n<5>Memory: 126848KB available (2712K code, 250K data, 96K init)\n<6>SLUB: Genslabs=11, HWalign=32, Order=0-1, MinObjects=4, CPUs=1, Nodes=1\n<7>Calibrating delay loop... 99.53 BogoMIPS (lpj=497664)\n<4>Mount-cache hash table entries: 512\n<6>CPU: Testing write buffer coherency: ok\n<6>net_namespace: 64 bytes\n<6>NET: Registered protocol family 16\n<6>L2X0 cache controller enabled\n<6>CPU is i.MX35 Revision 0.0\n<6>Clock input source is 24000000\n<6>MXC GPIO hardware\n<6>Using SDMA I.API\n<6>MXC DMA API initialized\n<6>CSPI: mxc_spi-0 probed\n<6>MXC I2C driver\n<4>clk: Unable to get requested clock: dfm_clk\n
Debugging kernel with jag/gdb
You need the poky gdb (compile using bitbake gdb-cross).
Build the kernel with debugging symbols, to do this you need to enable DEBUG_KERNEL and DEBUG_INFO in the .config.
On the mx35 processor you must pass "jtag=on" on the kernel command line when running with jtag. This changes prevents the cpu idle in arch_idle(). Without this the kernel does not work correctly, I've asked Freescale for an explanation.
When the kernel is booted you can connect to the peedi for debugging using:
arm-poky-linux-gnueabi-gdb vmlinx (gdb) target remote 192.168.1.77:2000
You can get additional debugging during the kernel initialization, by enabling "initcall_debug" during the boot:
exec -c "noinitrd initcall_debug console=ttymxc0,9600"
To set a breakpoint during kernel initialization, first find the start address of the kernel:
grep start_kernel System.map c0008984 T start_kernel
Then in peedi boot redboot and set a hardware breakpoint:
break add hard 0xc0008984
Load the kernel, the system will break at this point. Delete the hardware breakpoint:
break del all
And finally start gdb:
arm-poky-linux-gnueabi-gdb vmlinx (gdb) target remote 192.168.1.77:2000
Using initramfs as your root filesystem
During the bring up of fab4 pa2 the nand flash did not appear to be working correctly. To work around this a initramfs was compiled into the kernel as the root filesystem.
Enable BLK_DEV_INITRD and set CONFIG_INITRAMFS_SOURCE = "initramfs_list".
In the initramfs_list file include:
dir /dev 755 0 0 nod /dev/console 644 0 0 c 5 1 nod /dev/loop0 644 0 0 b 7 0 nod /dev/null 644 0 0 c 1 3 dir /bin 755 1000 1000 slink /bin/sh busybox 777 0 0 file /bin/busybox initramfs/busybox 755 0 0 dir /proc 755 0 0 dir /sys 755 0 0 dir /mnt 755 0 0 slink /init /bin/busybox 777 0 0 dir /etc 755 0 0 file /etc/inittab initramfs/inittab 755 0 0 file /etc/fstab initramfs/fstab 755 0 0 dir /lib 755 0 0 slink /lib/libcrypt.so.1 libcrypt-2.6.1.so 755 0 0 slink /lib/libm.so.6 libm-2.6.1.so 755 0 0 slink /lib/libc.so.6 libc-2.6.1.so 755 0 0 slink /lib/ld-linux.so.3 ld-2.6.1.so 755 0 0 file /lib/libcrypt-2.6.1.so initramfs/libcrypt-2.6.1.so 755 0 0 file /lib/libm-2.6.1.so initramfs/libm-2.6.1.so 755 0 0 file /lib/libgcc_s.so.1 initramfs/libgcc_s.so.1 755 0 0 file /lib/libc-2.6.1.so initramfs/libc-2.6.1.so 755 0 0 file /lib/ld-2.6.1.so initramfs/ld-2.6.1.so 755 0 0
And put the appropriate files into initramfs directory, these can be copied from the standard root filesystem.
The compiled kernel will include the root filesystem, and should allow access to a shell.
TODO
- Linux: add overlay filesystem
- Linux: remove unused drivers
- Linux: write test gpio driver
- Linux: Touchscreen IRQ
PA2 cheat sheet
To boot a PA2 board without a flash chip:
First boot redboot using:
memory write16 0xbb001e0a 0x02 memory load tftp://192.168.1.1/init.bin 0xbb000000 set pc 0xbb000000 breakpoint add hard 0xbb00047c go wait 500 memory load tftp://192.168.1.1/redboot.bin 0x87f00000 set pc 0x87f00714 go
Then load the kernel (it needs to include a initramfs) using:
ip -b load -r -b 0x100000 -v -h 192.168.1.1 zImage-fab4.bin exec -c "noinitrd console=ttymxc0,115200 jtag=on init=/init"
The kernel boots with busybox so the network can be tested for, example:
busybox mount -a busybox ifconfig eth0 hw ether 00:04:20:01:02:03 busybox ifconfig eth0 up busybox udhcpc eth0 busybox ping -c 10 192.168.1.1
Cheats during PA2 bring up at MV on-site:
To boot a PA2 board without a flash chip: First boot redboot using: memory write16 0xbb001e0a 0x02 memory load tftp://172.19.115.81/init.bin 0xbb000000 set pc 0xbb000000 breakpoint add hard 0xbb00047c go wait 500 memory load tftp://172.19.115.81/redboot.bin 0x87f00000 set pc 0x87f00714 go Then load the kernel (it needs to include a initramfs) using: ip -b load -r -b 0x100000 -v -h 172.19.115.81 zImage-fab4.bin exec -c "noinitrd console=ttymxc0,115200 jtag=on" exec -c "noinitrd console=ttymxc0,115200 jtag=on ip=dhcp nfsroot=172.19.115.81:/home/richard/poky/build/tmp/rootfs fec_mac=00:04:20:ff:00:00" The kernel boots with busybox so the network can be tested for, example: busybox mount -a busybox ifconfig eth0 hw ether 00:04:20:01:02:03 busybox ifconfig eth0 up busybox udhcpc eth0 busybox ping -c 10 172.19.115.81 To get full /dev: busybox mount -a busybox mount -t ramfs mdev /dev busybox mkdir /dev/pts busybox mount -t devpts devpts /dev/pts busybox mount -t ramfs mdev /etc busybox touch /etc/mdev.conf busybox mdev -s To program the flash from peedi flash prog tftp://172.19.115.81/redboot.bin bin 0x0 erase To program flash from redboot (does not work right yet): load -r -b 0x100000 -v -h 172.19.115.81 zImage-fab4.bin fis create -f 0x00000000 kernel fis create -l 0x00200000 -f 0x00000000 kernel Memory checks: mem read32 0xb8001000 0x3c mem read32 0x43fac000 0x27e x -b 0xb8001000 -l 0x3c -4 x -b 0x43fac000 -l 0x9f8 -4