Adapting the PowerPC 403 ROM Monitor Software for a 512Kb Flash Device

Adapting the PowerPC 403 ROM Monitor Software for a 512Kb Flash Device IBM Microelectronics Dept D95/Bldg 060 3039 Cornwallis Road Research Triangle Park, NC 27709 Version: 1 December 15, 1997 Abstract - This application note describes how to adapt the ROM Monitor code that is supplied with the PowerPC 403 Evaluation Board Kit (EVB), for a 512Kb flash device, the 29F040. The EVB is supplied with a 128Kb flash device, the Am29F010. The current code is made to be 512Kb flash part tolerant. This means you can plug a 512Kb flash part into the flash socket, and you can burn code into it, but it still puts the BIOS into the same place (0xFFFE0000) as for a 128Kb flash, and therefore only the top 128Kb can be used for the BIOS code. This document explains how the whole flash address space (0xFFF80000-0xFFFFFFFF) can be utilized. It also describes how the new code can be programmed into the flash memory. The IBM PowerPC 403 Evaluation Board (EVB) kit is a full featured prototype board for the PowerPC 403 embedded controllers. It includes hardware and software tools for the development of embedded PowerPC 403 applications. For more information about this kit, refer to the PowerPC 403 Evaluation Board Kit User s Manual. Included in the kit is the ROM Monitor program, which resides on a 128Kb flash device on the evaluation board. This program initializes the PowerPC PPC403 microprocessor and peripherals to enable serial and ethernet communication between a host system and the evaluation board. The ROM Monitor provides the means to load applications from the host onto the EVB and enables the debugging of applications with the RISCWatch source level debugger. The source code for the ROM Monitor program is included as part of the EVB kit. The user can modify the ROM Monitor code according to his own needs, and may need extra flash space for BIOS code. The current ROM Monitor code can run on a 512Kb flash device (which can be plugged directly into the evaluation board flash socket), but only the top 128Kb of the flash device can be utilized for BIOS code. It is possible to modify the ROM Monitor code so that the whole flash device can be utilized. The address space for a 512Kb device is 0xFFF80000 to 0xFFFFFFFF. The device is mapped at the top of the memory space, since it has to contain the reset vector at 0xFFFFFFFC, where code execution starts after reset, according to the embedded PowerPC architecture. This document will explain how to modify version 8.2 of the PowerPC 403 ROM Monitor code so that it can be mapped at the correct starting address for a 512Kb flash device. It then also describes how the new code can be written to this flash device. 1

MEMORY MAP Figure 1 shows the ROM Monitor memory map used for a 128Kb flash device. This flash part, the 29F010 is divided into eight 16Kb sectors. A sector is the smallest element that can be erased or overwritten separately. The top sector is used for the reset vector, which has to be at address 0xFFFFFFFC, and the Vital Product Data (VPD) information. Currently, the VPD contains only one field: a 12 character network hardware address. This is preceded and followed by formatting characters to identify this field to the ROM Monitor. These control characters specify the start and end of the VPD, as well as the type and length of information contained in it. The sector second from the top is used as nonvolatile memory (NVRAM), where configuration information, such as the ROM Monitor menu configuration and IP address setup, can be stored by the ROM Monitor. A complete sector must be reserved for the NVRAM, since it must be possible to erase and reprogram it without affecting the BIOS code or the VPD and reset vector. The remaining sectors (covering addresses 0xFFFE0000 to 0xFFFF7FFF) can be used for BIOS code. Branch To Entry Point VPD NVRAM BIOS Code 0xFFFFFFFC 0xFFFFC000 0xFFFF8000 0xFFFE0000 Figure 1. Memory Map for 128Kb flash The current code places the BIOS code at the same address (0xFFFE0000) for both 128Kb and 512Kb flash devices. In the 512Kb flash part, the sector size (smallest erasable element) is 64k, not 16k. Because of the larger sector size, the current code places the NVRAM at the beginning of the 512Kb ROM (0xFFF80000), since 0xFFFF8000 + 64Kb gives a greater address than 0xFFFFFFFF (and it would also overwrite the VPD). To make better use of the larger flash space, the VPD can be put in the top sector, starting at address 0xFFFF0000, and the NVRAM can be in the sector second from the top which starts at address 0xFFFE0000. The rest of the space (from 0xFFF80000 to 0xFFFDFFFF) can now be used for the BIOS code. This memory map is shown in figure 2. The following sections describe how to create the binary code file according to this memory map, and how to load it into the flash device. 2

Branch To Entry Point VPD NVRAM BIOS Code 0xFFFFFFFC 0xFFFF0000 0xFFFE0000 0xFFF80000 Figure 2. Memory Map for 512Kb flash MODIFYING THE ROM MONITOR BINARY FILE The file OPENBIOS.BIN is created using the make utility in the \OSOPEN\M403_EVB\OPENBIOS directory. This file is the executable binary representation of the ROM Monitor code, and it can be programmed directly into the ROM or flash memory. The code and the make process must be modified to produce code mapped at address 0xFFF80000, instead of 0xFFFE0000. To do this, the following files must be updated: OPENBIOS\INCLUDE\USR_FUNC.H This file contains definitions that specify the addresses of pointers that point to various functions. These pointers are located at specific addresses in the.text section, which is now located at 0xFFF80000 instead of 0xFFFE0000. All the 0xFFFExxxx values in the function pointer definitions must therefore be changed to 0xFFF8xxxx. OPENBIOS\M4\ROS_INC.INC This file is included in assembly source files and specifies the base address for the.text section where code is placed. The following line:.set..textaddr, 0xFFFE must be changed to:.set..textaddr, 0xFFF8 3

OPENBIOS\MAPFILE1 This file supplies the address of the.text section to the linker. The following line:.text = V0xFFFE0000 ; must be changed to:.text = V0xFFF80000 ; OPENBIOS\MAKEFILE.MAK In this make file, the hbranch utility is used to place the reset vector at the end of a binary image. The -s flag causes the image to be padded to a certain size. Since the size of the flash part is 512k, or 0x80000, the value after the -s flag of the hbranch command must be changed from 0x20000 to 0x80000. NONVOLATILE MEMORY ADDRESS The nonvolatile memory start address must be moved from 0x7FF80000 to 0x7FFE0000 for the 512Kb flash part to comply with the memory map in figure 2. To do this, the following two files must be modified: MISCLIB\NVRAM.C The preprocessor definition of NVRAM_START_512 must be modified so that it will have the value 0x7FFE0000: #define NVRAM_START_512 0x7FF80000 must be changed to: #define NVRAM_START_512 0x7FFE0000 MISCLIB\FLASHPRG.C This file contains code specific to the Am29F010 128Kb flash device. Since the 512Kb Am29F040 is part of the same family, the programming and erase algorithms are the same, and only minimal changes are necessary: In the flash_prog routine, the NVRAM sector is erased before writing new data. Currently, the sector at 0x7FF80000 is erased, instead of 0x7FFE0000. Since only the three most significant address bits of the flash device are used, any address in a sector can be used as the sector erase address. Therefore, all occurrences of 0x7FF80000 can be replaced with (start + offset) in the flash_prog routine code. 4

This will ensure that the sector containing the first address to be written will be erased before data is written. For instance, the line: (void)out8temp((char *)0x7FF80000, 0x30); must be changed to: (void)out8temp((char *)(start + offset), 0x30); CREATING THE OPENBIOS.BIN BINARY FILE After the changes in the previous section have been made, the binary file OPENBIOS.BIN can be created using the make utility: In the \OSOPEN\M403_EVB\OPENBIOS directory, enter the following command from the shell: make clean This will delete the result of previous code builds. Now enter the following command from the shell: make This will execute the make utility. You will be instructed to edit the FLASH.S file in the \OSOPEN\M403_EVB\OPENBIOS\MISCLIB directory, and to execute the make command again for a second and third time. The following section describes how to program the ROM Monitor binary file, OPENBIOS.BIN into the 512Kb flash memory: PROGRAMMING THE ROM MONITOR CODE INTO THE FLASH MEMORY PROGRAMMING THE FLASH USING A FLASH PROGRAMMER The binary file OPENBIOS.BIN can be programmed directly into a flash device if a flash programmer is available. The file must be loaded at address 0x00000 of the flash device. To do this refer to the instructions of the relevant programmer. When the flash device is programmed in this way, the hardware network address is hardcoded into the flash, since it is contained in the binary file. The network address is inserted into the binary file using the hbranch utility. The address can be changed by modifying the file MAKEFILE.MAK in the \OSOPEN\M403_EVB\OPENBIOS directory. In this file, the value after the -n flag of the hbranch command must be changed to the desired 12-digit network address. This address must be a unique 5

ethernet address. For new boards, a unique hardware ethernet address must obtained from the controlling authority. FLASH PROGRAMMING WRAPPER CODE Another way to program the binary file into the flash device is by using the wrapper code supplied with the EVB Kit. The source files for this wrapper code are supplied with the kit, and are located in the \OSOPEN\M403_EVB\OPENBIOS\FLASH directory. Using the make utility in this directory, an executable image is created that contains the binary file OPENBIOS.BIN. When this image is executed, the binary file is programmed into the flash memory. If this option is chosen to program the flash, it is not necessary to specify the hardware network address in the make file, since the wrapper code prompts the user to give the opportunity for changing the network address. Since the wrapper code was written for a 128Kb flash device, a few modifications are necessary. These modifications are described in the following section: MODIFYING THE WRAPPER CODE Two files in the \OSOPEN\M403_EVB\OPENBIOS\FLASH directory must be modified to program the OPENBIOS.BIN binary file into a 512Kb flash device: \OSOPEN\M403_EVB\OPENBIOS\FLASH\FLASH.C There are three places where an address counter can count from the start to the end of the flash space. In these cases 128*1024 is used as a comparator. Replace these with 512*1024, or by FLASH_SIZE where FLASH_SIZE is defined as 512*1024. In the flash_vfy routine, the flash contents is verified. Inside this routine, the address 0x7FFE0000 must be changed to 0x7FF80000. This gives the starting address of the flash part. The following #define statements must also be changed: VPD_OFFSET must be defined as 0x7FE00 (instead of 0x1FE00). This is the offset from the start of the flash to the address where the Vital Product Data (VPD) is stored. CONF_ADDR must be defined as 0x7FFE0000 (instead of 0x7FFF8000). This is the starting address of the configuration block. CONF_OFFSET must be defined as 0x60000 (instead of 0x18000). This is the offset from the start of the flash to the configuration address. RMON_OFFSET must be defined as 0x00000 (instead of 0x60000). This is the offset from the start of the flash to the start of the ROM Monitor BIOS code. 6

\OSOPEN\M403_EVB\OPENBIOS\FLASH\FLSHPROG.C This file contains code specific to the Am29F010 128Kb flash device. Since the 512Kb Am29F040 is part of the same family, the programming and erase algorithms are the same, and only the following changes are necessary: All the sectors of the flash part should be erased before new code is written. The current code erases only the two top sectors of a 512Kb flash device (from 0xFFFE0000 to the end of the address space). In the flash_prog routine, under the comment heading 512Kb Device. Erase sectors 6 and 7, the code must be modified to erase sectors 0 through 5 as well. This is done by inserting new code as shown below: existing code o (void)outbyte(0x7ff02aaa, 0x55); /* Setup command */ new code o (void)outbyte(0x7ff80000, 0x30); /* Erase Sector 0 */ new code o (void)outbyte(0x7ff90000, 0x30); /* Erase Sector 1 */ new code o (void)outbyte(0x7ffa0000, 0x30); /* Erase Sector 2 */ new code o (void)outbyte(0x7ffb0000, 0x30); /* Erase Sector 3 */ new code o (void)outbyte(0x7ffc0000, 0x30); /* Erase Sector 4 */ new code o (void)outbyte(0x7ffd0000, 0x30); /* Erase Sector 5 */ existing code o (void)outbyte(0x7ffe0000, 0x30); /* Erase Sector 6 */ existing code o (void)outbyte(0x7fff0000, 0x30); /* Erase Sector 7 */ After these erase commands, there are while (1) loops that wait for the erase cycle to complete. The current code only confirms erasing at the two top sectors. It is therefore necessary to insert while (1) loops for the addresses 0x7FF80000, 0x7FF90000... 0x7FFD0000. This can be done using a for loop, like the one used under the 128Kb Device. Erase sectors 0-7 heading, but with address increments of 0x10000 instead of 0x4000, and a starting address of 0x7FF80000 instead of 0x7FFE0000: for (sectaddr=0x7ff80000;sectaddr<0x7fffffff;sectaddr+=0x10000) { while (1) { if ((inbyte(sectaddr)&0x80)!=0) { break; } if ((inbyte(sectaddr)&0x20)!=0) { if ((inbyte(sectaddr)&0x80)!=0) { break; } else { return(-1); } } } } The two while (1) loops checking addresses 0x7FFE0000 and 0x7FFF0000 can be commented out. 7

BUILDING AND EXECUTING THE WRAPPER CODE To program the flash using the wrapper code, the OPENBIOS.BIN file must be incorporated into the executable image file that will program the contents of OPENBIOS.BIN into the flash memory. To do this enter the following commands in the \OSOPEN\M403_EVB\OPENBIOS\FLASH directory: make clean and then make This will produce the image file FLSHBOOT.IMG. This file must now be loaded and executed on the evaluation board. When the image is executing, the user will be prompted on the terminal emulator to give the option to change the hardware address and to cancel the programming if desired. After the execution has completed, the following message appears on the terminal emulator: -Verifying new FLASH Image... 524288 matches, 0 mismatches Update complete! All done! Three methods to load and execute the FLSHBOOT.IMG image will be discussed: USING RISCWATCH IN JTAG MODE Since it is likely that the 512Kb flash device that must be programmed will be blank, this method must be used to program the device initially. There is a RISCWatch command file in the \OSOPEN\M403_EVB\OPENBIOS\FLASH directory: RW_FLASH.CMD. When this file is executed, the PPC403 processor will be initialized, and the image file FLSHBOOT.IMG will be loaded and executed. This command file can only be used when RISCWatch is running in JTAG mode. Issue the following command to run the RISCWatch command file: exec \osopen\m403_evb\openbios\flash\rw_flash.cmd USING RISCWATCH IN ROM MONITOR MODE This can only be done in the case where the flash device already contains an existing ROM Monitor. Once the RISCWatch debugger is started in ROM Monitor mode, the following must be issued: load image \osopen\m403_evb\openbios\flash\flshboot.img logoff This will load and execute the image. 8

USING THE BOOTP SERVER The facilities of the ROM Monitor can used to download applications to the evaluation board. To do this the host workstation must be configured to support the bootp protocol and tftp daemons. This setup is described in the PowerPC Evaluation Board Kit User s Manual. The bootptab file specifies an image file that is loaded and executed upon a bootp request from the ROM Monitor. The FLSHBOOT.IMG file must be copied to this filename and location. To start the process, the board must be reset. The Debugger (option 5 in the ROM Monitor menu) must be disabled, and Ethernet boot source must be enabled. Choose option 0 from the ROM Monitor menu to exit the ROM Monitor. The ROM Monitor will then issue a bootp request. The image file will be loaded and executed. The following is an example of the messages that will appear on the terminal emulator when an image file is loaded and executed in this manner: ---------------------------- Debugger: Disabled ---------------------------- 1 - Enable/disable tests 2 - Enable/disable boot devices 3 - Change IP addresses 4 - Ping test 5 - Toggle ROM monitor debugger 6 - Toggle automatic menu 7 - Display configuration 8 - Save changes to configuration 9 - Set baud rate for s1 boot 0 - Exit menu and continue ->0 Booting from [ENET] Ethernet... Sending bootp request... Loading file "C:\BOOT\BOOT.IMG"... Sending tftp boot request... Transfer Complete... Loaded successfully... Entry point at 0xc0e8... ############### IBM 403 Evaluation Board FLASH Update ################ File OPENBIOS.BIN found in loaded image ROM Monitor Version 8.2 Network Address = 08005AC801F5 Do you wish to change Network Address? (y or n) n 9

WARNING: You are about to re-program your ROM Monitor FLASH image. Do NOT turn off power or press reset until this procedure is completed. Otherwise the card may be permanently damaged!!! Do you wish to continue? (y or n)y -Verifying new FLASH Image... 524288 matches, 0 mismatches Update complete! All done! WARNING: If the flash is programmed with code containing errors, or with code other than a ROM Monitor, the flash cannot be reprogrammed without a flash programmer, or by using RISCWatch in the JTAG mode. UPDATING THE ROM MONITOR SOFTWARE FOR OTHER FLASH DEVICES The erase and programming algorithms in the ROM Monitor were written for the Am29F010 flash. Since the software modifications discussed in this document are for the Am29F040, which is part of the same family, the erase and programming command codes are the same, and it was not necessary to rewrite it. The following files contain code specific to the Am29Fxxx family: \OSOPEN\M403_EVB\OPENBIOS\FLASH\ FLSHPROG.C \OSOPEN\M403_EVB\OPENBIOS\MISCLIB\FLASHPRG.C If a flash device from another family is used, it may be necessary to rewrite the erase and programming routines. The flash memory space chip select and timing configuration is specified in the BR0 register, the control register for memory bank 0. Currently it is set up for a 70ns flash with a maximum size of 1Mb. If a larger or slower flash is used, it will be necessary to change the memory bank setup. The Bank Size (BS) field in BR0 controls the size of the bank, and the Transfer Wait (TWT) field controls the wait states during flash access. For further information refer to the relevant PPC403GC/GA/GCX Embedded Controller User s Manual. CONCLUSION The source code of the PowerPC ROM Monitor is supplied with the EVB. This enables the user to modify it according to his own needs. It was seen that the software can be updated for a larger flash device of 512Kb. It can also be updated for other flash devices of different sizes and speeds. 10

International Business Machines Corporation, 1997 All Rights Reserved * Indicates a trademark or registered trademark of the International Business Machines Corporation. ** All other products and company names are trademarks or registered trademarks of their respective holders. IBM and IBM logo are registered trademarks of the International Business Machines Corporation. IBM will continue to enhance products and services as new technologies emerge. Therefore, IBM reserves the right to make changes to its products, other product information, and this publication without prior notice. Please contact your local IBM Microelectronics representative on specific standard configurations and options. IBM assumes no responsibility or liability for any use of the information contained herein. Nothing in this document shall operate as an express or implied license or indemnity under the intellectual property rights of IBM or third parties. NO WARRANTIES OF ANY KIND, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ARE OFFERED IN THIS DOCUMENT. 11