Fab4 Kernel Notes

From SqueezeboxWiki

Revision as of 08:44, 23 June 2010 by Soulkeeper (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Fab4 Board

Board revisions (see /proc/cpuinfo revision) :

Board	CPU	Revision
PA1	i.MX35 TO1	1
PA2	i.MX35 TO1	2
PA3/PB1	i.MX35 TO1	3
PA3/PB1	i.MX35 TO2	4

The following components are software controlled, and kernel drivers are needed to support them.

Function	Component	Notes
CPU	Freescale i.MX35
NAND Flash	~~K9F1208U08-J~~K9F1G08U0B-P	~~64M, Page 512+16 bytes, Erase 16k+512 bytes~~128M x 8, Page 2048+64 bytes, Erase 128k+4k bytes
LCD	Wintek WD-F4827VN-6FLWa (production) Sharp LQ043T3DX04 (early prototype)	Wintek requires some programming through SPI
Wlan	Marvel 8686
Codec1	AK4420ETP
Codec2	WM8974GEFL
Temperature sensor	TMP100
Ambient light sensor	TSL2569
secondary MCU for IR	CY8C21323 (256B/4kB)

GPIO assignment iMX35

To avoid undesirable glitches on output lines during boot, the level should be set first and then the direction is changed from input to output.

Signal name	iMX35 pin	Mode	Port	Direction	Notes
FAIL_SAFE#	FST/GPIO1_8	ALT5	GPIO1_8	INPUT	Active low while the reset button is pressed
SD_CD#	ATA_CS0/GPIO2_6	ALT5	GPIO2_6	INPUT (maybe IRQ?)	Check for driver hooks (RT). SD-Card detection (low = card detected)
SD_WP#	ATA_DMARQ/GPIO2_31	ALT5	GPIO2_31	INPUT	Check for driver hooks (RT). SD-Card write protection (low = write protection)
I2C_ATTN1#	I2C2_CLK/GPIO2_26	ALT5	GPIO2_26	INPUT (IRQ)	on 3-stack (touch panel interrupt GPIO1_4) (low = touchpanel requires attention)
I2C_ATTN2#	I2C2_DAT/GPIO2_27	ALT5	GPIO2_27	INPUT (IRQ)	IR MCU interrupt (low = MCU requires attention)
IR_SENSOR#	CAPTURE/GPIO1_4	ALT0	CAPIN1	INPUT	(low = IR @ 38kHz detected)
IR_LED	GPIO1_1/PWMO	ALT2	PWMO	INPUT if IR LED controlled by CY8C21323 or OUTPUT if IR LED controlled by iMX35
OSC_SEL2	TX5_RX0/GPIO1_10	ALT5	GPIO1_10	OUTPUT (low)	88.2/96 Select for AK4420 (low = 88.2, high = 96)
OSC_SEL1	TX4_RX1/GPIO1_11	ALT5	GPIO1_11	OUTPUT (low)	88.2/96 Select for WM8974 (low = 88.2, high = 96)
HDP_EN	ATA_RESET#/GPIO2_11	ALT5	GPIO2_11	OUTPUT (low)	Headphone enable (low = Geek Hole, high = Headphone)
USB_HOST_EN#	USBOTG_PWR/GPIO3_14	ALT 0	USBOTG_PWR	OUTPUT (high)	Check for driver hooks(RT). Control power to the USB port (low = USB port enable; high USB port disabled)
USB_HOST_OC#	USBOTG_OC/GPIO3_15	ALT 0	USBOTG_OC	INPUT	Check for driver hooks(RT). Over-current detection on the USB port (low = OC detected; high = normal)
LCD_DISP	D3_SPL/GPIO1_5	ALT5	GPIO1_5	OUTPUT (low)	needs to be driven from low to high once after init lcd (VSYNC must be running)
LED_PWM	CONTRAST/GPIO1_1	ALT0	DISPB_CONTR	OUTPUT (low)
HDP_DET	ATA_DIOW/GPIO2_9	ALT5	GPIO2_9	INPUT (IRQ?)	low = 3.5mm jack not plugged, high = 3.5mm jack plugged
WIFI_PD#	ATA_DIOR/GPIO2_8	ALT5	GPIO2_8	OUTPUT (high)	WLAN Power (low = power-down mode)
WIFI_RESET#	ATA_CS1/GPIO2_7	ALT5	GPIO2_7	OUTPUT (low)	WLAN RESET#, needs to be driven from low to high once after power on reset and possibly each time WIFI_PD# goes active low
DAC1_SMUTE	ATA_INTRQ/GPIO2_29	ALT5	GPIO2_29	OUTPUT (low)	(low = not muted; high = muted)
IR_XRES	ATA_DA2/GPIO3_2	ALT5	GPIO3_2	INPUT (100k pull-down)	IR MCU reset; used to re-flash CY8C21323 (new on PA3)
IR_XSCL	ATA_DA0/GPIO3_0	ALT5	GPIO3_0	INPUT (100k pull-down)	IR MCU ISSP clock line; used to re-flash CY8C21323 (new on PA3)
IR_XSDA	ATA_DA1/GPIO3_1	ALT5	GPIO3_1	INPUT (100k pull-down)	IR MCU ISSP data line; used to re-flash CY8C21323 (new on PA3)
RESERVED (IR_BLASTER_EN)	ATA_DMACK/GPIO2_10	ALT5	GPIO2_10	INPUT (no pull-up/down and no keeper)	Enable the logic to blast IR through the geek hole when HDP_EN is inactive (new on PA3)

I2C addresses

device	7-bit addresss	400kHz capable
TMP100	0x48	yes
TSL2569	0x39	yes
CY8C21323	0x47	yes
WM8974	0x1a (on PA3)	yes

SPI addresses

device	chip select
WM8974	SPI1_SS0# (on PA2)
LCD	SPI1_SS1#

Programming the Wintek LCD

The following stream of 16bits words needs to be send:
~~0x0020, 0x041f.~~ No programming required.
The format is:

D[15..10]	address
D[9]	0: write 1: read
D[8]	guard bit for HiZ transition when reading
D[7..0]	data to be written

CY8C21323 (IR MCU)

Resetting the CY8C21323 (IR MCU)

The CY8C21323 should be reset by iMX35 through pin IR_XRES when the OS is booting. To reset the IR MCU, set the GPIO to output high for 1ms and set it back to input again while keeping the 100k pull-down enabled.

Flashing the CY8C21323 (IR MCU)

The CY8C21323 can be re-flashed through the ISSP (In-System Serial Program) pins by using the Reset Mode explained in the application note AN2026a. http://download.cypress.com.edgesuite.net/design_resources/application_notes/contents/in_system_serial_programming__issp__protocol_for_cy8c21xxx_cy8c22xxx_cy8c24xxx_cy8c24xxxa_cy8c27xxx___an2026a_12.pdf

DDR2

From Freescale iMX35 Errata 4 June 2008:

The EMI hangs up when the ARM Platform accesses certain DDR2 addresses in burst mode:
- External 16bit DDR2 memory:
o INCRx.
o WRAPx.
o Address ending 0x4 and 0xC.
- External 32bit DDR2 memory:
o INCRx.
o WRAPx.
o Address ending 0x8.
All other AHB Masters, besides ARM Platform, won’t cause this problem.
Impact:
EMI locks. No instruction execution, no debug break. Need system reset to recover.
Workaround:
- The 16 bit mode has no workaround.
- On 32 bit mode, by writing bit12 of L2CCAUX register, there will be no WRAPx burst from ARMP. And INCRx from ARMP will not be with start address ending 0x8. Thus there is no hang up.
- Use Mobile DDR.

The L2CCAUXCR is described in Section 17.3.3.

SPDIF clock

The magic search keyword is 'osc_audio'. This signal comes from audio xtal as shown in Figure 5-2. The clock tree is "shown" in Figure 5-10. Also take a look at 'osc_audio' in figure 61-2.

System Boot

The mx35 supports several boot modes:

External Boot (BMOD[1..0] = 10)

This is the boot mode configured on the PA1 boards. Section 7 is a little light on details "MXIMX35 supports direct boot from NAND flash".

This is the mode supported by Redboot/Linux on the 3-stack.

Booting from NAND flash is described in more detail in Section 29.9.2.

bootloader copies 4 pages (from 1/2KB flash) into NFC internal RAM buffer.

EEC is used, always calculated on 1/2KB data. So if 2k or 4k page flash is used then it gets complicated :).

Internal Boot (BMOD[1..0] = 00): This mode will try to boot from NAND flash, and if that fails will allow booting from usb/serial as a backup.; The first block of the flash needs to be duplicated (in case the first block is bad).; 4-bit or 8-bit EEC is used when loading from the flash.; A flash header is needed in front of the bootloader, this includes a magic barker code and code signatures for the boot code.

So do we really need the USB/Serial backup for flashing the boards? If we do it means modifying the bootloader build to add the flash header.

Using the internal mode allows the first block of flash to be bad. This should not be a problem as the flash is fully guaranteed that the 1st block is valid and it does not require ECC.

Redboot

Redboot is extended to support the Fab4 board in packages/hal/arm/mx35/fab4. This is initially a clone of the mx35-3stack board, with the following changes:

Update board and machine type (in hal_arm_board.cdl). A new machine type is registered for Fab4, see http://www.arm.linux.org.uk/developer/machines/?action=list&id=1804.
Use 128M DDR2 memory.
Removed references to the PMIC chip, and related chip select pins.
Removed flashing debug LED in the redboot idle loop.
Added support for the physical reset button to halt the boot script.
Added support for UBI (includes minor changes to the mxc_nfc to report bad blocks).
Allow default values for boot_script_* to be compiled in.
Allow default values for FEC to be compiled in.

Useful references in the code:

packages/hal/arm/arch/current/src/vectors.S

ARM exception vectors

reset_vector, calls PLATFORM_SETUP1 out of reset for board configuration (see below).

other non-platform init code, and jumps to eCos kernel.

packages/hal/arm/mx35/fab4/include/hal_platform_setup.h

Initial assembler setup including

ARM1136 init

L2 cache setup

aips

max

m3if

clocks

sdram (in our case ddr2)

copy image from flash (config the nand flash controller, bad block handling is commented out). an alternative CYG_HAL_STARTUP_ROMRAM may be used on our platform. [RT - check this]

c-stack

mmu

See this analysis Fab4 Bootloader Init.

In redboot.elf most of the code starts from 0x00008000. The exception vectors and platform setup is compiled to 0x87f00000.

packages/hal/arm/mx35/fab4/current/include/pkgconf/mlt_arm_board_romram.lid: Linker file, this sets the ROM address to start at 0x87f00000.

packages/hal/arm/arch/current/src/redboot_linux_exec.c: do_exec() is the code that boots linux after setting up the tag param block.

* How does the initial boot loader code get put in the first flash block, and how big is it * *

Flash partition table

The following partition table will be used initially for the PA1 prototypes:

i.MX35 3-stack

Partition	Erase Blocks	Start Block	Start Address	Length
redboot	1		0		0x00000000	0x00040000
kernel		8		1		0x00040000	0x00200000
kernel		8		9		0x00240000	0x00200000
cramfs		80		17		0x00440000	0x01400000
cramfs		80		97		0x01840000	0x01400000
yaffs		80		177		0x02C40000	0x01400000
*spare*	7929		257		0x04040000	0x7be40000
redboot config	1		8186		0x7FE80000	0x00040000
FIS directory	1		8187		0x7FEC0000	0x00040000
Linux BBT	4		8188		0x7FF00000	0x00100000
End				8192		0x80000000

PA1

Partition	Erase Blocks	Start Block	Start Address	Length
redboot	16		0		0x00000000	0x00040000
kernel		116		16		0x00040000	0x001D0000
kernel		116		132		0x00210000	0x001D0000
cramfs		1280		248		0x003E0000	0x01400000
cramfs		1280		1528		0x017E0000	0x01400000
yaffs		1282		2808		0x02BE0000	0x01408000
redboot config	1		4090		0x03FE8000	0x00004000
FIS directory	1		4091		0x03FEC000	0x00004000
Linux BBT	4		4092		0x03FF0000	0x00010000
End				4096		0x04000000

UBI/UBIFS

The following partition table will be used after conversion from cramfs/yaffs to ubi/ubifs.

Partition	Erase Blocks	Start Block	Start Address	Length
redboot	16		0		0x00000000	0x00040000
kernel		116		16		0x00040000	0x001D0000
kernel		116		132		0x00210000	0x001D0000
ubi		3842		248		0x003E0000	0x03C08000
redboot config	1		4090		0x03FE8000	0x00004000
FIS directory	1		4091		0x03FEC000	0x00004000
Linux BBT	4		4092		0x03FF0000	0x00010000
End				4096		0x04000000

Building Redboot

Redboot it not yet included in the SqueezeOS build process. Use the following instructions to build redboot.

First checkout the bootloader from "https://svn.slimdevices.com/repos/jive/7.4/private-branches/fab4/bootloaders/imx35"
Configure your environment (assumes the bootloader is checed out in imx35-bootloader):

export PATH=~/imx35-bootloader/gnutools/arm-elf/bin/:~/imx35-bootloader/bin/:$PATH
export ECOS_REPOSITORY=~/imx35-bootloader/imx35/ecos_20050912/packages/

Configure the build:

mkdir ecos-build
cd ecos-build
ecosconfig new mx35_fab4 redboot
ecosconfig import $ECOS_REPOSITORY/hal/arm/mx35/fab4/current/misc/redboot_ROMRAM.ecm
ecosconfig import $ECOS_REPOSITORY/hal/arm/mx35/fab4/current/misc/redboot_fab4.ecm
ecosconfig add UBI
ecosconfig tree

Make the build

make

The redboot image is in install/bin/redboot.bin

Redboot Commands

Original fconfig from Freescale

RedBoot> fconfig -n -l
boot_script: true
boot_script_data:
.. fis load kernel
.. exec -c "noinitrd console=ttymxc0,115200 root=/dev/mtdblock8 rw rootfstype=cramfs"
boot_script_timeout: 1
bootp: true
bootp_server_ip: 192.168.1.79
brd_specs: 0
console_baud_rate: 115200
eth0_esa: false
fec_esa: false
gdb_port: 9000
info_console_force: false
net_debug: false
net_device: mxc_fec

Initialize flash

Note: redboot already needs to be written to the flash starting in block 0.

Note: the following commands use the 3-stack addresses and need converting for the smaller flash chips.

Initialize configuration:

RedBoot> fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load kernel
>> exec -c "noinitrd console=ttymxc0,115200 root=/dev/mtdblock2 ro rootfstype=cramfs init=/linuxrc"
>>
Boot script timeout (1000ms resolution): 1
Use BOOTP for network configuration: true
Default server IP address: 192.168.1.79
Board specifics: 0
Console baud rate: 115200
Set eth0 network hardware address [MAC]: false
Set FEC network hardware address [MAC]: false
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Default network device: mxc_fec
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0x7fe80000-0x7fe81000: .
... Program from 0x07eb3000-0x07eb4000 at 0x7fe80000: .

Initialize filesystem:

fis init -i

# kernel
load -v -r -b 0x100000 zImage
fis create -l 0x00200000 -f 0x00040000 kernel

# cramfs
load -v -r -b 0x100000 root.cramfs
fis create -l 0x01400000 -f 0x00440000 root

# jffs2
fis create -n -l 0x01400000 -f 0x02C40000 jffs2

# spare (on 3-stack only)
fis create -n -l 0x7BE40000 -f 0x04040000 spare

Upgrade redboot

load -v -r -b 0x100000 redboot.bin
run
# this runs the new image, test it works then:
romupdate

Upgrade kernel

load -v -r -b 0x100000 zImage
fis create kernel

Upgrade root filesystem

load -v -r -b 0x100000 root.cramfs
fis create root

Redboot and JTAG

The initial bootloader code is in hal_platform_setup.h. This initialized the ARM core, DDR2 memory and loads Redboot from flash.

When the mx35 is powered on the first two pages of flash are loaded in to the NFC (nand flash controller) buffer at 0xbb000000. When the boot switches are set to "external boot" the code is normally executed from this buffer.

While using jtag it is useful to set the boot switch to "no boot" (11). Then to execute this code from peedi use:

set pc 0xbb000000
go

Other code can be loaded into this flash buffer, but first it must be unlocked. For example to load init.bin (the first 2k of the bootloader) use:

memory write16 0xbb001e0a 0x02
memory load tftp://192.168.1.1/init.bin 0xbb000000

To boot without using the flash use:

memory write 16 0xbb001e0a 0x02
memory load tftp://192.168.1.1/init.bin 0xbb000000
set pc 0xbb000000
breakpoint add hard 0xbb00047c
go
wait 500
memory load tftp://192.168.1.1./redboot.bin 0x87f00000
set pc 0x87f00714
go

Where the address are (use objdump to look these up from redboot.elf):

0xbb00047c HWInitialize_skip_SDRAM_setup
0x87f00714 HWInitialize_skip_SDRAM_copy

You can debug Redboot using the arm-elf-gdb from the ecos toolchain. To do this first initialize the DDR2 memory using (this example runs from flash):

set pc 0xbb000000
breakpoint add hard 0xbb00047c
go

Then in gdb use:

target remote 172.19.114.50:2000
load
set $pc=0x87f00714
c

You can use breakpoints, etc. in gdb as normal.

Linux Kernel

When it dosen't boot

Ok, so you've got as far as:

Uncompressing Linux............................................................................................... done,
 booting the kernel.

Then what? Well you can inspect the buffered printk() boot messages via jtag. First you need to find the address of the log buffer:

$ grep __log_buf System.map
c02e7820 b __log_buf

Then using the jtag look at the messages:

fab4> mem read$ 0xc02e7820   
0xC02E7820: <5>Linux version 2.6.24-186-g43e77a6 (richard@richard-desktop) (gcc version 4.2.3) #1 PREEMPT Wed Sep 3
21:30:34 BST 2008\n<4>CPU: ARMv6-compatible processor [4117b363] revision 3 (ARMv6TEJ), cr=00c5387f\n<4>Machine: 
Logitech Fab4 Board\n<4>Memory policy: ECC disabled, Data cache writeback\n<7>On node 0 totalpages: 32768\n<7>  DMA 
zone: 48 pages used for memmap\n<7>  DMA zone: 0 pages reserved\n<7>  DMA zone: 6096 pages, LIFO batch:0\n<7>  
Normal zone: 208 pages used for memmap\n<7>  Normal zone: 26416 pages, LIFO batch:7\n<7>  Movable zone: 0 pages used 
for memmap\n<4>CPU0: D VIPT write-back cache\n<4>CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 
sets\n<4>CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets\n<4>Built 1 zonelists in Zone order, 
mobility grouping on.  Total pages: 32512\n<5>Kernel command line: noinitrd console=ttymxc0,9600\n<6>MXC IRQ 
initialized\n<4>PID hash table entries: 512 (order: 9, 2048 bytes)\n<6>MXC GPT timer initialized, rate = 
16625000\n<4>Console: colour dummy device 80x30\n<6>Dentry cache hash table entries: 16384 (order: 4, 65536 
bytes)\n<6>Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)\n<6>Memory: 128MB = 128MB total\n<5>Memory: 
126848KB available (2712K code, 250K data, 96K init)\n<6>SLUB: Genslabs=11, HWalign=32, Order=0-1, MinObjects=4, 
CPUs=1, Nodes=1\n<7>Calibrating delay loop... 99.53 BogoMIPS (lpj=497664)\n<4>Mount-cache hash table entries: 
512\n<6>CPU: Testing write buffer coherency: ok\n<6>net_namespace: 64 bytes\n<6>NET: Registered protocol family 
16\n<6>L2X0 cache controller enabled\n<6>CPU is i.MX35 Revision 0.0\n<6>Clock input source is 24000000\n<6>MXC GPIO 
hardware\n<6>Using SDMA I.API\n<6>MXC DMA API initialized\n<6>CSPI: mxc_spi-0 probed\n<6>MXC I2C driver\n<4>clk: 
Unable to get requested clock: dfm_clk\n

Debugging kernel with jag/gdb

You need the poky gdb (compile using bitbake gdb-cross).

Build the kernel with debugging symbols, to do this you need to enable DEBUG_KERNEL and DEBUG_INFO in the .config.

On the mx35 processor you must pass "jtag=on" on the kernel command line when running with jtag. This changes prevents the cpu idle in arch_idle(). Without this the kernel does not work correctly, I've asked Freescale for an explanation.

When the kernel is booted you can connect to the peedi for debugging using:

arm-poky-linux-gnueabi-gdb vmlinx
(gdb) target remote 192.168.1.77:2000

You can get additional debugging during the kernel initialization, by enabling "initcall_debug" during the boot:

exec -c "noinitrd initcall_debug console=ttymxc0,9600"

To set a breakpoint during kernel initialization, first find the start address of the kernel:

grep start_kernel System.map
c0008984 T start_kernel

Then in peedi boot redboot and set a hardware breakpoint:

break add hard 0xc0008984

Load the kernel, the system will break at this point. Delete the hardware breakpoint:

break del all

And finally start gdb:

arm-poky-linux-gnueabi-gdb vmlinx
(gdb) target remote 192.168.1.77:2000

Using initramfs as your root filesystem

During the bring up of fab4 pa2 the nand flash did not appear to be working correctly. To work around this a initramfs was compiled into the kernel as the root filesystem.

Enable BLK_DEV_INITRD and set CONFIG_INITRAMFS_SOURCE = "initramfs_list".

In the initramfs_list file include:

dir /dev 755 0 0
nod /dev/console 644 0 0 c 5 1
nod /dev/loop0 644 0 0 b 7 0
nod /dev/null 644 0 0 c 1 3
dir /bin 755 1000 1000
slink /bin/sh busybox 777 0 0
file /bin/busybox initramfs/busybox 755 0 0
dir /proc 755 0 0
dir /sys 755 0 0
dir /mnt 755 0 0
slink /init /bin/busybox 777 0 0
dir /etc 755 0 0
file /etc/inittab initramfs/inittab 755 0 0
file /etc/fstab initramfs/fstab 755 0 0
dir /lib 755 0 0
slink /lib/libcrypt.so.1 libcrypt-2.6.1.so 755 0 0
slink /lib/libm.so.6 libm-2.6.1.so 755 0 0
slink /lib/libc.so.6 libc-2.6.1.so 755 0 0
slink /lib/ld-linux.so.3 ld-2.6.1.so 755 0 0
file /lib/libcrypt-2.6.1.so initramfs/libcrypt-2.6.1.so 755 0 0
file /lib/libm-2.6.1.so initramfs/libm-2.6.1.so 755 0 0
file /lib/libgcc_s.so.1 initramfs/libgcc_s.so.1 755 0 0
file /lib/libc-2.6.1.so initramfs/libc-2.6.1.so 755 0 0
file /lib/ld-2.6.1.so initramfs/ld-2.6.1.so 755 0 0

And put the appropriate files into initramfs directory, these can be copied from the standard root filesystem.

The compiled kernel will include the root filesystem, and should allow access to a shell.

TODO

Linux: add overlay filesystem
Linux: remove unused drivers
Linux: write test gpio driver
Linux: Touchscreen IRQ

PA2 cheat sheet

To boot a PA2 board without a flash chip:

First boot redboot using:

memory write16 0xbb001e0a 0x02
memory load tftp://192.168.1.1/init.bin 0xbb000000
set pc 0xbb000000
breakpoint add hard 0xbb00047c
go
wait 500
memory load tftp://192.168.1.1/redboot.bin 0x87f00000
set pc 0x87f00714
go

Then load the kernel (it needs to include a initramfs) using:

ip -b
load -r -b 0x100000 -v -h 192.168.1.1 zImage-fab4.bin
exec -c "noinitrd console=ttymxc0,115200 jtag=on init=/init"

The kernel boots with busybox so the network can be tested for, example:

busybox mount -a
busybox ifconfig eth0 hw ether 00:04:20:01:02:03
busybox ifconfig eth0 up
busybox udhcpc eth0
busybox ping -c 10 192.168.1.1

Cheats during PA2 bring up at MV on-site:

To boot a PA2 board without a flash chip:

First boot redboot using:

memory write16 0xbb001e0a 0x02
memory load tftp://172.19.115.81/init.bin 0xbb000000
set pc 0xbb000000
breakpoint add hard 0xbb00047c
go
wait 500
memory load tftp://172.19.115.81/redboot.bin 0x87f00000
set pc 0x87f00714
go

Then load the kernel (it needs to include a initramfs) using:

ip -b
load -r -b 0x100000 -v -h 172.19.115.81 zImage-fab4.bin
exec -c "noinitrd console=ttymxc0,115200 jtag=on"

exec -c "noinitrd console=ttymxc0,115200 jtag=on ip=dhcp nfsroot=172.19.115.81:/home/richard/poky/build/tmp/rootfs fec_mac=00:04:20:ff:00:00"

The kernel boots with busybox so the network can be tested for, example:

busybox mount -a
busybox ifconfig eth0 hw ether 00:04:20:01:02:03
busybox ifconfig eth0 up
busybox udhcpc eth0
busybox ping -c 10 172.19.115.81

To get full /dev:

busybox mount -a
busybox mount -t ramfs mdev /dev
busybox mkdir /dev/pts
busybox mount -t devpts devpts /dev/pts
busybox mount -t ramfs mdev /etc
busybox touch /etc/mdev.conf
busybox mdev -s

To program the flash from peedi

flash prog tftp://172.19.115.81/redboot.bin bin 0x0 erase

To program flash from redboot (does not work right yet):

load -r -b 0x100000 -v -h 172.19.115.81 zImage-fab4.bin
fis create -f 0x00000000 kernel

fis create -l 0x00200000 -f 0x00000000 kernel

Memory checks:

mem read32 0xb8001000 0x3c
mem read32 0x43fac000 0x27e

x -b 0xb8001000 -l 0x3c -4
x -b 0x43fac000 -l 0x9f8 -4