LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware > Linux - Embedded & Single-board computer
User Name
Password
Linux - Embedded & Single-board computer This forum is for the discussion of Linux on both embedded devices and single-board computers (such as the Raspberry Pi, BeagleBoard and PandaBoard). Discussions involving Arduino, plug computers and other micro-controller like devices are also welcome.

Notices



Reply
 
Search this Thread
Old 07-27-2014, 10:30 AM   #1
dorsio
Member
 
Registered: Apr 2014
Posts: 48

Rep: Reputation: Disabled
flashing NVRAM from U-Boot shell


Does it possible to flash NVRAM from U-Boot via the serial port? I know its possible from U-Boot to upload the firmware to router memory and install it. Here is an example, showing how to unbrick router with Serial Line Recovery, using HyperTerminal in Windows to transfer binary. Is it possible to use the same method for reflashing NVRAM by loading nvram backup from U-Boot via the serial port?(the host OS Windows).
Cable modem appears to have nvram corrupted. U-Boot 1.2.0 bootloader is working, I can connect to modem via serial interface, view boot process and upload firmware.

I dont know to which memory address to upload the nvram to.
Code:
loady 0x007b0000
What are the next steps after the upload is complete? (erase the NVRAM, then copy new, reset?)And what's target addresses in memory?

Code:
erase 0x007b0000 0x00800000
cp.b 0x00000000 0x007b0000 0x00050000
bootm 0x00000000
Flash memory structure, from U-Boot printenv:
Code:
Serial Flash [Bus:0 CS:0] : s25fl064a 8192KB, 128 sectors each  64KB
7 cmdlinepart partitions found on MTD device spansion
partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }
partitions[1] = {.name = env1, .offset = 0x00020000,.size = 0x00010000 (64K) }
partitions[2] = {.name = env2, .offset = 0x00030000,.size = 0x00010000 (64K) }
partitions[3] = {.name = firmware_EH, .offset = 0x004a0000,.size = 0x002d0000 (2880K) }
partitions[4] = {.name = nvram, .offset = 0x007b0000,.size = 0x00050000 (320K) }
partitions[5] = {.name = UBFI1, .offset = 0x00040000,.size = 0x003b0000 (3776K) }
partitions[6] = {.name = UBFI2, .offset = 0x003f0000,.size = 0x003b0000 (3776K) }
Creating 7 MTD partitions on "spansion":
0x00000000-0x00020000 : "U-Boot"
0x00020000-0x00030000 : "env1"
0x00030000-0x00040000 : "env2"
0x004a0000-0x00770000 : "firmware_EH"
0x007b0000-0x00800000 : "nvram"
0x00040000-0x003f0000 : "UBFI1"
0x003f0000-0x007a0000 : "UBFI2"
FLASH memory information => flinfo
Code:
Bank # 1: Spansion Serial Flash FLASH_S25FL064A
  Size: 8 MB in 128 Sectors
  Sector Start Addresses:
    48000000 (RO) 48010000 (RO) 48020000 (RO) 48030000 (RO) 48040000
    48050000      48060000      48070000      48080000      48090000
    480A0000      480B0000      480C0000      480D0000      480E0000
    480F0000      48100000      48110000      48120000      48130000
    48140000      48150000      48160000      48170000      48180000
    48190000      481A0000      481B0000      481C0000      481D0000
    481E0000      481F0000      48200000      48210000      48220000
    48230000      48240000      48250000      48260000      48270000
    48280000      48290000      482A0000      482B0000      482C0000
    482D0000      482E0000      482F0000      48300000      48310000
    48320000      48330000      48340000      48350000      48360000
    48370000      48380000      48390000      483A0000      483B0000
    483C0000      483D0000      483E0000      483F0000      48400000
    48410000      48420000      48430000      48440000      48450000
    48460000      48470000      48480000      48490000      484A0000
    484B0000      484C0000      484D0000      484E0000      484F0000
    48500000      48510000      48520000      48530000      48540000
    48550000      48560000      48570000      48580000      48590000
    485A0000      485B0000      485C0000      485D0000      485E0000
    485F0000      48600000      48610000      48620000      48630000
    48640000      48650000      48660000      48670000      48680000
    48690000      486A0000      486B0000      486C0000      486D0000
    486E0000      486F0000      48700000      48710000      48720000
    48730000      48740000      48750000      48760000      48770000
    48780000      48790000      487A0000      487B0000      487C0000
    487D0000      487E0000      487F0000

Last edited by dorsio; 08-02-2014 at 01:21 PM.
 
Old 07-28-2014, 04:47 AM   #2
SIG_SEGV
Member
 
Registered: Jul 2012
Location: Banglore, INDIA
Distribution: Fedora-Core
Posts: 70

Rep: Reputation: 11
I dont think the command 'erase' writes into NVRAM....

Look for an embedded app meant for writing data to nvram....Or you can write it by your own..
(*addr) = 0x0000;

Use tftp to get the nvram content into the RAM (any non-active empty space ex: 0x200000) ...Then use:
cp.b <copied_RAM_addr> <NVRAM physical address: get it from mapping table in u-boot> <size of content>


I think this should work...
 
Old 07-28-2014, 07:18 AM   #3
dorsio
Member
 
Registered: Apr 2014
Posts: 48

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by SIG_SEGV View Post
I dont think the command 'erase' writes into NVRAM....

Look for an embedded app meant for writing data to nvram....Or you can write it by your own..
(*addr) = 0x0000;

Use tftp to get the nvram content into the RAM (any non-active empty space ex: 0x200000) ...Then use:
cp.b <copied_RAM_addr> <NVRAM physical address: get it from mapping table in u-boot> <size of content>


I think this should work...
I mean with command 'erase' old data should be erased first (as writing to flash memory may fail when the target area has not been erased). I don't have embedded app, I mean use U-Boot commands.
I want try Hyperterminal to transfer nvram content into the RAM.

For erase command, is this correct [start] [end] addresses for "nvram"?

erase 0x007b0000 0x00800000

What specifically is the non-active empty space address in my case?

NVRAM physical address from mapping table in u-boot: is it 0x007b0000?

How to get size of content bytes, NVRAM.bin in proper format?

Last edited by dorsio; 07-28-2014 at 07:22 AM.
 
Old 07-28-2014, 10:35 AM   #4
SIG_SEGV
Member
 
Registered: Jul 2012
Location: Banglore, INDIA
Distribution: Fedora-Core
Posts: 70

Rep: Reputation: 11
Quote:
I mean with command 'erase' old data should be erased first (as writing to flash memory may fail when the target area has not been erased). I don't have embedded app, I mean use U-Boot commands.
I want try Hyperterminal to transfer nvram content into the RAM.

For erase command, is this correct [start] [end] addresses for "nvram"?

erase 0x007b0000 0x00800000

erase cmd is meant for erasing flash (NOR/NAND) and erase basincally mean wrirting 0xfffff...
So after u execute erase with your NVRAM addr, it internally checks whether those addr come in constraint of addr mapped under flash area....Since nvram addr are not flash addr...it ignores writing to ur specified area....

so ur cmd
erase 0x007b0000 0x00800000
doesnt work hopefully....

Jst write your own app wth instrs as below:

for loop with nvram constraint addr
{
*(volatile unsigned long *)addr = 0xffffffff (or) 0x0000;
incr add wth 4;
}

Quote:
What specifically is the non-active empty space address in my case?
find out what RAM addr does your bootloader/kernel uploader app uses in boot loader env.
Coz, these cmds use empty space in RAM to copy data from tftp to RAM and then to flash via
cp.b/w/l

Normally uboot resides at bottom region of RAM... So, i think you can use top area of ram to copy nvram image/content.


Quote:
NVRAM physical address from mapping table in u-boot: is it 0x007b0000?
Yes it is: You can even check it in bootloader/include/configs/processor-name_configs.h

You should find all the interface mapping here.......


Quote:
How to get size of content bytes, NVRAM.bin in proper format?
du -sh <file_name>
or
ls -l <file_name>
 
Old 07-28-2014, 03:09 PM   #5
dorsio
Member
 
Registered: Apr 2014
Posts: 48

Original Poster
Rep: Reputation: Disabled
Ohh, I have no firmware source code at all, so can't check bootloader/include/configs/processor-name_configs. U-boot have the following commands. Host OS is Windows as well.

When doing firmware update from TFTP server, the firmware Load address is 0x80000100: can it be used as non-active empty space for loading nvram?

Last edited by dorsio; 07-31-2014 at 08:41 AM.
 
Old 07-29-2014, 02:09 AM   #6
SIG_SEGV
Member
 
Registered: Jul 2012
Location: Banglore, INDIA
Distribution: Fedora-Core
Posts: 70

Rep: Reputation: 11
Quote:
Ohh, I have no firmware source code at all, so can't check bootloader/include/configs/processor-name_configs. I can only use this U-boot commands available. Host OS is Windows as well.

So, nvram does not allows writing to specified area. But when the target area hasn't been erased, or if its write-protected, writing to flash memory may fail. Is there a solution with U-Boot then?
I just re-read the guide about Flashing from U-boot, there are mentioned commands 'erase the NVRAM'. Perhaps I'm missing something.
You can use "mw" command to write/erase NVRAM area from the commands link you hve given ...
ex: mw.l <addr> <data> <Length of memory/4>

Quote:
When doing firmware update from TFTP server, the firmware Load address is 0x80000100: can it be used as non-active empty space for loading nvram?
Yes you can use same addr....for copying NVRAM.bin to RAM (from tftp command) and then copy that image from RAM ( 0x80000100) to NVRAM physical area (0x007b0000) using cp.b cmd & specifying the size of image....

Better hve a linux OS....Coz i dont have idea of tftp in windows...If you know you can carry on!!!

Last edited by SIG_SEGV; 07-29-2014 at 02:10 AM.
 
Old 07-29-2014, 06:52 AM   #7
dorsio
Member
 
Registered: Apr 2014
Posts: 48

Original Poster
Rep: Reputation: Disabled
Thanks for tips. I found the sequence of commands U-boot use for upgrades. Based on this it should be:
Code:
tftp 0x80000100 nvram.bin 

protect off 0x007b0000 +0x00050000
erase 0x007b0000 +0x00050000 
sleep 3
cp.b 0x80000100 0x007b0000 0x00050000
protect on 0x007b0000 +0x00050000
I tried commands, but got error 'bad address format' (I tried also another representation of addresses):

Code:
=> tftp 0x80000100 NVRAM.bin
TFTP from server 192.168.100.2; our IP address is 192.168.100.1
Filename 'NVRAM.bin'.
Load address: 0x80000100
Loading: T #################################################################
done
Bytes transferred = 327680 (50000 hex)
=> protect off 0x007b0000 +0x00050000
Error: end address (0x007fffff) not in flash!
Bad address format
=> protect off 0x7b0000 +0x50000
Usage:
protect - enable or disable FLASH write protection

Last edited by dorsio; 08-01-2014 at 05:53 AM.
 
Old 07-29-2014, 07:10 AM   #8
SIG_SEGV
Member
 
Registered: Jul 2012
Location: Banglore, INDIA
Distribution: Fedora-Core
Posts: 70

Rep: Reputation: 11
That's why i told you erase doesn't work for you since NVRAM area address you are specifying is not under flash region.

erase only works for flash area...

Try writing to NVRAM using

mw.l

as i mentioned above
 
Old 07-29-2014, 08:36 AM   #9
dorsio
Member
 
Registered: Apr 2014
Posts: 48

Original Poster
Rep: Reputation: Disabled
But I tried unprotect nvram area, not erase. It doesn't allow unprotect?
 
Old 07-29-2014, 08:43 AM   #10
SIG_SEGV
Member
 
Registered: Jul 2012
Location: Banglore, INDIA
Distribution: Fedora-Core
Posts: 70

Rep: Reputation: 11
Use mw.l on NVRAM addresses directly... and try


Don not use protect off/on
 
Old 07-29-2014, 09:18 AM   #11
dorsio
Member
 
Registered: Apr 2014
Posts: 48

Original Poster
Rep: Reputation: Disabled
not sure the second value (any data?) and third argument (327680/4 = 81920)?
Code:
mw.l 0x007b0000 0x44400000  81920
 
Old 07-29-2014, 09:20 AM   #12
SIG_SEGV
Member
 
Registered: Jul 2012
Location: Banglore, INDIA
Distribution: Fedora-Core
Posts: 70

Rep: Reputation: 11
why any data....
better give a 0xffffffff or 0x00000000 for uniform pattern as a function of erase.
 
Old 07-29-2014, 09:29 AM   #13
dorsio
Member
 
Registered: Apr 2014
Posts: 48

Original Poster
Rep: Reputation: Disabled
the lenght of memory(1/4) in decimal (81920) or hex (0x00014000)?
 
Old 07-29-2014, 09:48 AM   #14
SIG_SEGV
Member
 
Registered: Jul 2012
Location: Banglore, INDIA
Distribution: Fedora-Core
Posts: 70

Rep: Reputation: 11
give a hex 0x....
 
Old 07-29-2014, 02:34 PM   #15
dorsio
Member
 
Registered: Apr 2014
Posts: 48

Original Poster
Rep: Reputation: Disabled
tried, nothing has been updated after command

=> mw.l 0x007b0000 0xffffffff 0x00014000
=> cp.b 0x80000100 0x007b0000 0x00050000
=>
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Serial terminal connected to USB Serial Port on Ubuntu 12.04 809areacode Linux - General 3 07-18-2013 11:06 PM
Is a USBtty (USB serial port) treated the same as tty (normal serial port) in C? spudgunner Programming 1 11-12-2010 02:19 PM
Boot messages to serial port fanoliv Ubuntu 7 03-10-2008 10:04 PM
Parallel Port & Serial Port device identification helpmeforlinux Linux - Hardware 3 01-02-2007 02:15 AM
Using serial port card(PCMCIA) with IPAQ running Linux, can't find ttyS0 port d2army Linux - Laptop and Netbook 0 11-12-2005 09:07 PM


All times are GMT -5. The time now is 08:17 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration