Update u-boot via serial communication

[gauthier]

I have build a u-boot.imx for my imx6qsabresd. I would like to download it to target without removing the SD card, using Kermit.

This is what I have done so far:

- setup kermit on host with the following settings:

set line /dev/ttyUSB0

set speed 115200

set carrier-watch off

set handshake none

set flow-control none

robust

set file type bin

set file name lit

set rec pack 1000

set send pack 1000

set window 5

- start Kermit and connect to target.

- reset the target and stop autoboot to get into u-boot

- tell u-boot to take a transfer with

U-Boot > loadb 0x0400

(is this the correct address to put u-boot?)

- disconnected to return to kermit, and started file transfer:

C-Kermit> send u-boot.imx

(is this the correct file?)

I only get packet time outs.

I tried earlier to put the file at 0x00800000, and there I got 40 packets of size ~1000 sent. Then the packets timed out. This tells me the transmission is ok, maybe there wasn't enough room there to put the ~300 kB of u-boot. Maybe I just can't write there from the serial link?

How can I update my u-boot with a serial connection? What am I doing wrong?

[yahuicao]

Hi Gauthier:

    Your kermit configuration is OK. I think the problem lies in the load address. the command loadb load the file into the DDR ram, if you are not sure where to put the file downloaded by loadb, then use the 0x10800000 which is the kernel load address by default and there must be enough space for your u-boot image.

After you have downloaded the u-boot image into the DDR, then use the mmc write command, I list my operations below:

U-Boot 2009.08 (Aug 16 2013 - 12:04:20)

CPU: Freescale i.MX6 family TO1.2 at 792 MHz

Thermal sensor with ratio = 175

Temperature:  43 C, calibration data 0x5534cd69

mx6q pll1: 792MHz

mx6q pll2: 528MHz

mx6q pll3: 480MHz

mx6q pll8: 50MHz

ipg clock    : 66000000Hz

ipg per clock : 66000000Hz

uart clock    : 80000000Hz

cspi clock    : 60000000Hz

ahb clock    : 132000000Hz

axi clock  : 264000000Hz

emi_slow clock: 132000000Hz

ddr clock    : 528000000Hz

usdhc1 clock  : 198000000Hz

usdhc2 clock  : 198000000Hz

usdhc3 clock  : 198000000Hz

usdhc4 clock  : 198000000Hz

nfc clock    : 24000000Hz

Board: i.MX6Q-SABRESD: RevC Board: 0x63312 [POR ]

Boot Device: MMC

I2C:  ready

DRAM:  1 GB

MMC:  FSL_USDHC: 0,FSL_USDHC: 1,FSL_USDHC: 2,FSL_USDHC: 3

*** Warning - bad CRC or MMC, using default environment

In:    serial

Out:  serial

Err:  serial

i2c: I2C3 SDA is low, start i2c recovery...

I2C3 Recovery success

Found PFUZE100! deviceid=10,revid=10

Net:  got MAC address from IIM: 00:04:9f:02:19:3c

FEC0 [PRIME]

Hit any key to stop autoboot:  0

MX6Q SABRESD U-Boot >

MX6Q SABRESD U-Boot >

MX6Q SABRESD U-Boot > loadb 0x10800000

## Ready for binary (kermit) download to 0x10800000 at 115200 bps...

Now escape back to the kermit shell prompt (ctrl+\ followed by ctrl+c by default). Tell kermit to transmit the file you want by doing:

C-Kermit>send /path/to/file/you/want/to/load

（Start transfer）

……………………

……………………

……………………

……………………

……………………

C-Kermit>connect

Connecting to /dev/ttyUSB0, speed 115200

Escape character: Ctrl-\ (ASCII 28, FS): enabled

Type the escape character followed by C to get back,

or followed by ? to see other options.

----------------------------------------------------

## Total Size      = 0x0006b7a4 = 440228 Bytes

## Start Addr      = 0x10800000

MX6Q SABRESD U-Boot > mmc dev 2

mmc2 is current device

(here chose your SD Card, here mmc dev 2 refers to SD3(J507) )

MX6Q SABRESD U-Boot > mmc write 0x10800400 0x2 0x400

MMC write: dev # 2, block # 2, count 1024 ... 1024 blocks write: OK

（Assume u-boot is less than 512KB, and we write the image from 0x2 block with the length of 0x400(1024),By default, 1 block = 512 byte, so 0x400 block = 512KB.

Notes: We need to skip the first 1KB address of the SD Card, which is used for the MBR and partition table. So write the DDR address into the flash from the address 0x10800000 + 0x400 )

In addition , you can refer to the bootloaders:u-boot:serial_port_loading_files [Analog Devices Open Source| Mixed-signal and Digital S... for more details.

Now the u-boot has been updated . Reboot your board, and enjoy it ! : - )

[gauthier]

Thanks for the answer!

Sending to 0x10800000 worked, as well as giving `loadb` no argument at all (it chose 0x12000000 by default).

However when I try to run the newly uploaded bootloader in RAM with:

    go 0x10800000

I get the following error:

U-Boot > go 0x10800000

## Starting application at 0x10800000 ...

data abort

    MAYBE you should read doc/README.arm-unaligned-accesses

pc : [<10800038>]      lr : [<4ff7b188>]

sp : 4f576e10  ip : 0000001c    fp : 4f577b28

r10: 4ffbb200  r9 : 4f576f38    r8 : 00000002

r7 : 4f577b38  r6 : 10800000    r5 : 00000002  r4 : 4f577b3c

r3 : 10800000  r2 : 4f577b3c    r1 : 00000000  r0 : 00000001

Flags: nZCv  IRQs off  FIQs off  Mode SVC_32

Resetting CPU ...

resetting ...

I read arm-unaligned-accesses. Since the flashed bootloader is supposed to start at byte 1024, I tried uploading to 0x10800400 instead, but that didn't help. The imx file is ok (I checked this by loading it with a card reader on host), so I wonder how to solve running the new bootloader from RAM, to verify it works before flashing.

One other thing I do not understand is that when I put the imx onto the SD card in my host's card reader, I put it at address 1024 (dd with bs=1k seek=1). I suppose it puts the beginning of the imx file onto address 1024.

In your description it seems like you mmc-write not the *beginning* of the imx to 1024, but imx+1024 (0x10800400) to 1024.

Obviously there is something I misunderstand, but it seems to me they are placed differently. I don't get why both work.

[yahuicao]

Well, actually, compiled u-boot.imx contains a 1KB pad at the head, and if you want to execute the downloaded image in DDR, you need to execute at u-boot:

go 0x10800400 (Suppose you execute 'loadb 0x10800000' to download the image at 0x10800000)

(So if you go 0x10800000, the code at the 0x010800000 is not executable, and you will get exception as you mentioned.)

However, the u-boot consist of 1st stage and 2nd stage, while the 1st stage(mainly initialize the memory system like DDR, nand ,clocks and so on) is executed in the on-chip ram of the i.MX at boot time. So execute the u-boot image directly the way above will not work normally.

If you want to debug the u-boot at the ram, you need to extract the 2nd stage to the DDR and 'go' there.

For the second problem, you mentioned:

' when I put the imx onto the SD card in my host's card reader, I put it at address 1024 (dd with bs=1k seek=1)'

Here I think you missed some parameter with the dd to burn the u-boot, the correct command is :

dd with bs=1k seek=1 skip=1

So it copys the u-boot.imx image from the start of 1024 address to the iNAND's 1024 address. And it works the same as the way I have done on the u-boot mmc write operation.

Here the first 1024 bytes of the u-boot.imx is padding data(no meaning), while the first 1024 bytes of iNAND stores the MBR and partition table, which is very critical and can't be overwritten.

[gauthier]

I tried downloading at 0x10800000, then 'go' at 0x10800400. What starts is not the u-boot I just downloaded, but the u-boot in flash. I am sure that the imx I transmitted to 0x1080000 with loadb/send was another version (2014.04). No error message. When I had the alignment error I understood, the u-boot to fall back to was the one in flash. Here I get no hint on what went wrong.

Here is the whole procedure:

U-Boot 2013.10 (Jun 09 2014 - 16:34:51)

CPU:  Freescale i.MX6Q rev1.2 at 792 MHz

Reset cause: POR

Board: MX6-SabreSD

DRAM:  1 GiB

MMC:  FSL_SDHC: 0, FSL_SDHC: 1, FSL_SDHC: 2

*** Warning - bad CRC, using default environment

auto-detected panel HDMI

Display: HDMI (1024x768)

In:    serial

Out:  serial

Err:  serial

Net:  FEC [PRIME]

Hit any key to stop autoboot:  0

U-Boot > loadb 0x10800000

## Ready for binary (kermit) download to 0x10800000 at 115200 bps...

(Back at sobel)

----------------------------------------------------

(/home/gauthier/) C-Kermit>cd code/u-boot

(/home/gauthier/code/u-boot/) C-Kermit>send u-boot.imx

(/home/gauthier/code/u-boot/) C-Kermit>connect

Connecting to /dev/ttyUSB0, speed 115200

Escape character: Ctrl-\ (ASCII 28, FS): enabled

Type the escape character followed by C to get back,

or followed by ? to see other options.

----------------------------------------------------

## Total Size      = 0x00050c00 = 330752 Bytes

## Start Addr      = 0x10800000

U-Boot > go 0x10800400

## Starting application at 0x10800400 ...

U-Boot 2013.10 (Jun 09 2014 - 16:34:51)

CPU:  Freescale i.MX6Q rev1.2 at 792 MHz

Reset cause: WDOG

Board: MX6-SabreSD

DRAM:  1 GiB

MMC:  FSL_SDHC: 0, FSL_SDHC: 1, FSL_SDHC: 2

*** Warning - bad CRC, using default environment

auto-detected panel HDMI

Display: HDMI (1024x768)

I am not sure I understand why 'go' does not work there. Since I am already in u-boot (the one in flash), "initialize the memory system like DDR, nand ,clock and so on" is already done? Why would it need to be done again?

I would be happy to test "extract the 2nd stage to the DDR and 'go' there", but I really don't know how.

Second problem: when I have used dd without skip, u-boot.imx have worked fine. Both the one generated by the fsl-community, and the ones I have compiled myself.

I tried to dd an imx with skip, and the bootloader did not start. The guide by Daiane does it without skip.

What you say does make sense though, but I don't understand why it's working.

From this answer, it seems that the header in the imx format is: "This IVT header is for our boot ROM to identify the u-boot's location & function etc...", "which mode need to execute, DCD or PLUG, if DCD mode, then where to find the DRAM config data, and after DRAM configured, where to read the reset uboot image and where to put this image, in which DRAM address". Maybe that is what you meant?

[yahuicao]

Well, maybe I didn't make it clearly that I download the u-boot.bin into the DDR by loadb and mmc-write it into the iNAND, I haven't used u-boot.imx before. After check this page u-boot.bin and u-boot.imx, I think the u-boot.imx equals another 1KB data at the head(which is meaningful here) plus u-boot.bin. Above all, I tested with the u-boot.bin, while you tested with the u-boot.imx. So this is the problem.

I checked  your u-boot operation procedure, after go 0x10800400,  the log shows that the system crashes and then reboot. So I don't suggest that you execute the whole u-boot image in the DDR. About executing the second stage in DDR, it is a little bit complicated and you need to study the code in u-boot and modify the link table of the u-boot. For the purpose of debuging, you need to pay much effort and it isn't quite straightforward as it seems..

[gauthier]

Ok, that makes sense!

At my first try (my second post), there was an apparent crash:

U-Boot > go 0x10800000

## Starting application at 0x10800000 ...

data abort

    MAYBE you should read doc/README.arm-unaligned-accesses

pc : [<10800038>]      lr : [<4ff7b188>]

sp : 4f576e10  ip : 0000001c    fp : 4f577b28

r10: 4ffbb200  r9 : 4f576f38    r8 : 00000002

r7 : 4f577b38  r6 : 10800000    r5 : 00000002  r4 : 4f577b3c

r3 : 10800000  r2 : 4f577b3c    r1 : 00000000  r0 : 00000001

Flags: nZCv  IRQs off  FIQs off  Mode SVC_32

Resetting CPU ...

resetting ...

In the following try (go 0x18000400), the Reset cause is the watchdog. Is that why you write that the system crashes?

[yahuicao]

Well, could you please set this question as answered if you think this is done ? Thanks:smileyhappy:

[andyhuang]

I update the uboot.imx with the serial , execute 'mmc write 0x10800000 0x1 0x400' after 'loadb 0x10800000', and  it write success, but when set "go 0x10800000" or "go 0x10800400", or reset , the u-boot is not updated.

U-Boot 2009.08 (Nov 13 2013 - 11:06:28)

CPU: Freescale i.MX6 family TO1.2 at 792 MHz

Temperature:   39 C, calibration data 0x54b4a77d

mx6q pll1: 792MHz

mx6q pll2: 528MHz

mx6q pll3: 480MHz

mx6q pll8: 50MHz

ipg clock     : 66000000Hz

ipg per clock : 66000000Hz

uart clock    : 80000000Hz

cspi clock    : 60000000Hz

ahb clock     : 132000000Hz

axi clock   : 264000000Hz

emi_slow clock: 132000000Hz

ddr clock     : 528000000Hz

usdhc1 clock  : 198000000Hz

usdhc2 clock  : 198000000Hz

usdhc3 clock  : 198000000Hz

usdhc4 clock  : 198000000Hz

nfc clock     : 24000000Hz

Board: MX6Q-SABRELITE:[ POR]

Boot Device: I2C

I2C:   ready

DRAM:   1 GB

MMC:   FSL_USDHC: 0,FSL_USDHC: 1

JEDEC ID: 0xbf:0x25:0x41

Reading SPI NOR flash 0xc0000 [0x2000 bytes] -> ram 0x276009b8

SUCCESS

In:    serial

Out:   serial

Err:   serial

Net:   got MAC address from IIM: 00:00:00:00:00:00

FEC0 [PRIME]

Hit any key to stop autoboot:  0

MX6Q SABRELITE U-Boot > loadb 0x10800000

## Ready for binary (kermit) download to 0x10800000 at 115200 bps...

## Total Size      = 0x0004e55c = 320860 Bytes

## Start Addr      = 0x10800000

MX6Q SABRELITE U-Boot > mmc dev 1

mmc1 is current device

MX6Q SABRELITE U-Boot > mmc dev 3

MMC Device 3 not found

no mmc device at slot 3

MX6Q SABRELITE U-Boot > mmc dev 2

MMC Device 2 not found

no mmc device at slot 2

MX6Q SABRELITE U-Boot > mmc dev 1

mmc1 is current device

MX6Q SABRELITE U-Boot >  mmc write 0x10800400 0x1 0x400

MMC write: dev # 1, block # 1, count 1024 ... 1024 blocks write: OK

MX6Q SABRELITE U-Boot > go 0x10800000

## Starting application at 0x10800000 ...

[yahuicao]

Yes, I checked that line "Reset cause: WDOG",and I think the reset cause is the watchdog.

So if you want to update the u-boot.imx in the iNAND instead of u-boot.bin, just execute 'mmc write 0x10800000 0x2 0x400' after 'loadb 0x10800000', and I've verified that it works OK:smileyhappy: