Fab4 Firmware Upgrades and Recovery
From SqueezeboxWiki
Engineering Fab4 VM
A Ubuntu VMware image has been set up for fab4 development in MV. It's IP address is 172.19.113.252, username is 'sdi'. It includes redboot and poky build environments, a tftp server (put files in /var/lib/tftpboot) and a http server (put files in /var/www).
Checking NAND flash with jtag/PEEDI
To check the NAND flash using jtag/PEEDI use:
fab4> flash info
FLASH configuration for core #0:
Nand ID : 0xEC, 0xF1, 0x0, 0x95, 0x0
Nand Flash: Samsung, ID=0xF1, 8-bit, 128 MB
page size = 2048 + 64 bytes
pages per block = 64
number of blocks = 1024
number of bad blocks = 1 (use "flash query" to get the list)
erase bad blocks = false
OOB Info: IMX_ECC
Burst mode: yes
This reports the flash chip and also the number of bad blocks on the chip. You get more details on the bad blocks using "flash query"
Install using jtag/PEEDI on PA2 boards
This MUST only be used with blank flash parts. UBI maintains an EC (erase counter) for each block of flash and following these steps will destroy the EC. After the initial programming follow the instructions for upgrading using Redboot or Linux
NOTE: This procedure is not recommend for PA3 boards as RedBoot is programmed on the flash before SMT
You need the latest redboot.bin and squeezeos-image-fab4.ubi files available on an http server, in this example we are using the fab4 VM http://172.19.113.252. To upgrade the flash follow these steps:
- Select 1 on the PEEDI front panel and hit start.
- This will perform a mass erase on the flash (skipping bad blocks)
- Select 2 on the PEEDI front panel and hit start.
- This will load RedBoot into the target memory.
- On the serial console type 'factive nand'
- This configures RedBoot for NAND flash.
- On the serial console type 'nand scan -r'.
- This creates the NAND bad block table on the flash.
- Select 3 on the PEEDI front panel and hit start.
- This will program RedBoot and the UBI image to the flash.
- Disconnect the PEEDI and reset the target.
To initialize RedBoot hit the reset button. The follow the instructions below to configure the mac address and uuid.
Install on PA3/PB1 boards and factory line upgrades
The PA3 and PB1 builds have RedBoot pre-programmed to the flash before SMT. The following steps should be followed to complete the initial installation. When automated these steps will also be suitable for the factory upgrades.
I've just realized you probably want instructions for doing this via ethernet, not serial. If so let me know
The following steps don't include RedBoot upgrades, this could be optionally added.
1. Operator connects serial connection and power.
2. Operator presses reset button for 2 seconds.
3. Script monitors the serial port watching for:
Searching for BBT table in the flash ...
4. Script checks the RedBoot debug to see if a bad block table has already been created. If it has you'll find a string similar to:
Searching for BBT table in the flash ... Found version 1 Bbt0 at block 1023 (0x7fe0000)
Otherwise you'll see:
Searching for BBT table in the flash ... No BBT table found. Need to do "nand scan" first
If the bad block table already exists skip to step 6.
5. Program the bad block table. *This step MUST only be done if no bad block table exists*.
RedBoot> nand scan -r Force re-scan ... Do low level scan to construct BBT Block 0 is bad Block 1 is bad Block 748 is bad Total bad blocks: 3 Writing Bbt0 to flash Writing BBT at offset 0x7fe0000 size=256 Format successful
Note: it detects blocks 0 and 1 as bad. They are not, but RedBoot is installed over the bad block markers making the block appear bad. When DataI/O can preprogram the bad block table on the flash this step won't be required.
6. Configure Ethernet using dhcp.
RedBoot> ip_address -b IP: 192.168.1.91/255.255.255.0, Gateway: 192.168.1.254 Default server: 0.0.0.0
This does not always work, so you might have to repeat this step. On an error you'll see:
RedBoot> ip_address -b ... waiting for BOOTP information BUG[RX]: status=882, length=40 Failed to get BOOTP address IP: 0.0.0.0/255.255.255.0, Gateway: 0.0.0.0 Default server: 0.0.0.0
Note: David you could configure a static IP address here.
7. Load UBI image.
RedBoot> load -v -r -b 0x100000 -h 192.168.1.1 squeezeos-image-fab4.ubi Using default protocol (TFTP) \ Raw file loaded 0x00100000-0x00afffff, assumed entry at 0x00100000
8. Program the flash
RedBoot> ubi format ........................................................................................................................ ........................................................................................................................ ........................................................................................................................ ........................................................................................................................ ........................................................................................................................ ........................................................................................................................ .........................skipping bad block 744 ........................................................................................................................ ........................................................................................................................ ............................... scanning 1016 PEBs skipping bad block 744 scanning is finished
The MAC and uuid can then be programmed following the steps below.
Redboot and Board Revisions
It is important that the correct version of the bootloader is used for the with the correct board revision, otherwise the system may not boot or it may be unstable.
| Build | i.MX35 Rev | Board Rev | Bootloader |
|---|---|---|---|
| PA3 | TO1 | 0002 | redboot-0002.bin |
| PB1 | TO1 | 0003 | redboot-0003.bin |
| PB1 | TO2 | 0004 | redboot-0004.bin |
| PB2 | TO2 | 0005 | redboot-0005.bin |
Setting MAC address, Serial and UUID
The MAC address, serial number and UUID can be set in RedBoot using:
board_serial is formatted as follows:
DDMM-YYbd-idAB-CDab
where
DDMM-YY production DateMonth-Year 0512-08 => 05-12-2008
bd-id board ID 00-01 => 0001 (range 0001-FFFF)
AB- device color 00 => 00 (range 00-FF)
CD device buildup 00 => 00 (range 00-FF)
ab unused 00 => unused
color definitions
xxxxxxxx
Black => 00
Red => 01
White => 02
Fab4
Black => 00
device buildup
Standard => 00 (all)
RedBoot> fconfig board_serial 0512-0800-0000-0000 board_serial: Setting to 0512-0800-0000-0000 Update RedBoot non-volatile configuration - continue (y/n)? y RedBoot> fconfig board_uuid 550e8400-e29b-41d4-a716-446655440000 board_uuid: Setting to 550e8400-e29b-41d4-a716-446655440000 Update RedBoot non-volatile configuration - continue (y/n)? y RedBoot> fconfig fec_esa_data 0x00:0x04:0x20:0x08:0x05:0x12 fec_esa_data: Setting to 0x00:0x04:0x20:0x08:0x05:0x12 Update RedBoot non-volatile configuration - continue (y/n)? y
This data MUST be set in every unit!!
Rebooting the target, and voilà it boots! To verify the information has been set correctly in linux use:
# cat /proc/cpuinfo ... Hardware : Logitech Fab4 Board Revision : 0003 Serial : 0512080001080512 UUID : 550e8400-e29b-41d4-a716-446655440000 # ifconfig eth0 Link encap:Ethernet HWaddr 00:40:20:08:05:12 ...
Also note the 'Revision' must match the hardware revision, so 3 for PA3/PB1. If this is incorrect then the wrong version of the bootloader is being used on the board, and things may not work correctly.
Recovery in RedBoot
You need the latest files (e.g., redboot.bin, squeezeos-image-fab4.ubi) available on an tftp server*, in this example we are using the fab4 VM 172.19.113.252.
To access the RedBoot prompt you must press the reset button for 2 seconds. The unit will then acquire an IP address using DHCP. Access to RedBoot is now possible via the serial connection, or using telnet on port 9000.
- To install a tftp server on an Ubuntu machine, I found this link very helpful
To upgrade RedBoot use:
RedBoot> load -v -r -b 0x100000 -h 172.19.113.252 redboot.bin Using default protocol (TFTP) \ Raw file loaded 0x00100000-0x001320d7, assumed entry at 0x00100000 RedBoot> run load entry_address=0x100000 virt_addr=0x100000 phys_addr=0x80100000 ++Searching for BBT table in the flash ... Found version 1 Bbt0 at block 4095 (0x3ffc000) Block 16 is bad Block 3156 is bad Total bad blocks: 2 **Warning** FLASH configuration checksum error or invalid key Use 'fconfig -i' to [re]initialize database Ethernet FEC MAC address: is not set hardware reset by POR Clock input is 24 MHz Booting from [SDRAM] Ringo Chip is working in auto mode [Warning] FEC not connect right PHY: ID=800000 FEC: [ HALF_DUPLEX ] [ connected ] [ 10M bps ]: Ethernet mxc_fec: MAC address 00:00:45:67:89:ab IP: 192.168.1.83/255.255.255.0, Gateway: 192.168.1.254 Default server: 0.0.0.0 RedBoot(tm) bootstrap and debug environment [ROMRAM] Non-certified release, version FSL 200824 - built 11:14:38, Sep 30 2008 Platform: Logitech Fab4 (i.MX35 ) PASS 1.0 [x32 DDR] Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc. RAM: 0x00000000-0x07f00000, [0x00025640-0x07eed000] available FLASH: 0x00000000 - 0x4000000, 4096 blocks of 0x00004000 bytes each. RedBoot> romupdate Updating ROM in NAND flash
This loads in the new version of the boot loader and executes it. During development any changes can be tested at this stage. The romupdate command will store the running version of Redboot to flash.
Updating UBI image (kernel and root filesystem)
# On PA2: RedBoot> ubi attach -f 0x40000 -l 0x07F00000 -w 0x800 -e 0x20000 -s 0x200 # On PA3: RedBoot> ubi attach -f 0x80000 -l 0x07EC0000 -w 0x800 -e 0x20000 -s 0x200 scanning 1016 PEBs skipping bad block 910 scanning is finished RedBoot> load -v -r -b 0x100000 -h 172.19.113.252 squeezeos-image-fab4.ubi Using default protocol (TFTP) - Raw file loaded 0x00100000-0x0099ffff, assumed entry at 0x00100000 RedBoot> ubi format ........................................................................................................................ ........................................................................................................................ ........................................................................................................................ ........................................................................................................................ ........................................................................................................................ ........................................................................................................................ ........................................................................................................................ .......................................................................skipping bad block 910 ......................................................................................................... scanning 1016 PEBs skipping bad block 910 scanning is finished RedBoot> ubi info Volumes count: 7 Logical eraseblock size: 129024 Total amount of logical eraseblocks: 1014 (130830336 bytes) Amount of available logical eraseblocks: 738 (95219712 bytes) Maximum count of volumes 128 Count of bad physical eraseblocks: 2 Count of reserved physical eraseblocks: 10 Current min/mean/max erase counter: 3/3/3 Minimum input/output unit size: 2048 bytes VID header offset: 512 ----------------------------------- Volume ID: 0 Type: static Alignment: 1 Size: 17 LEBs (2228224 bytes) Used: 15 LEBs (1841968 bytes) State: OK Name: kernel ----------------------------------- Volume ID: 1 Type: static Alignment: 1 Size: 163 LEBs (21364736 bytes) Used: 52 LEBs (6668288 bytes) State: OK Name: cramfs ----------------------------------- Volume ID: 2 Type: dynamic Alignment: 1 Size: 82 LEBs (10747904 bytes) State: OK Name: ubifs ----------------------------------- Volume ID: 2147479551 Type: dynamic Alignment: 0 Size: 0 LEBs (0 bytes) State: OK Name:
ubi attach configures the UBI driver and performs an initial scan. ubi format stores the ubi image while preserving the UBI ECs. You can use ubi info to show information about the volumes that have been stored on the flash.
Upgrade in Linux
todo...
RedBoot Configuration
It can be useful to change the default RedBoot configuration during testing and development. Don't forget use the reset button to gain access to the RedBoot via serial or telnet. Some useful settings follow.
During development and testing the boot_script_timeout can be set to allow Ctrl-C to abort the boot script. In production systems this must be set to 0 (the default).
RedBoot> fconfig boot_script_timeout 10 boot_script_timeout: Setting to 10 Update RedBoot non-volatile configuration - continue (y/n)? y
To change the kernel boot parameters use (for PB2):
RedBoot> fconfig boot_script_data
boot_script_data:
.. ubi attach -f 0x80000 -l 0x07EC0000 -w 0x800 -e 0x20000 -s 0x200
.. ubi load -b 0x100000 kernel
.. exec -c %{os_cmdline}
Enter script, terminate with empty line
>> # Enter_your_boot_script_here
>>
Update RedBoot non-volatile configuration - continue (y/n)? y
RedBoot>
When using jtag an additional command line parameter must be passed to the kernel, use the following boot script (for PB2):
ubi attach -f 0x80000 -l 0x07EC0000 -w 0x800 -e 0x20000 -s 0x200
ubi load -b 0x100000 kernel
exec -c %{os_cmdline}
To run with a development kernel loaded using tftp:
ip_address -b
load -r -b 0x100000 -v -h 192.168.1.87 zImage-fab4.bin
exec -c %{os_cmdline}
To run with an nfs root filesystem modify the os_cmdline alias using:
alias os_cmdline "console=ttymxc0,115200 noinitrd ip=dhcp nfsroot=192.168.1.96:/home/richard/rootfs init=/bin/sh %{os_cmdargs}"
Create a RedBoot only Image (under construction)
- Select 1 on the PEEDI front panel and hit start.
- This will perform a mass erase on the flash (skipping bad blocks)
- Select 2 on the PEEDI front panel and hit start.
- This will load RedBoot into the target memory.
- On the serial console type 'factive nand'
- This configures RedBoot for NAND flash.
- On the serial console type 'romupdate'
- This stores the running version of Redboot to flash.
- Boot from the newly created image.
- On the serial console type 'x -b 0xbb001e0c -2 -l 4' and check the two 16 bits values don't contain any F
- This make sure ECC was correctly programmed in the image.
