ertec400 boot manual v101 - siemens · 2015-01-20 · the checksum parameter “chksum” that is...

Copyright © Siemens AG 2010. All rights Reserved. 1 ERTEC 400 Boot Description Technical data subject to change Version 1.0.1

ERTEC 400

Boot Mode Description

Manual


Ausgabe (07/2010)

Disclaimer of Liability

We have checked the contents of this manual for agreement with the hardware and software

described. Since deviations cannot be precluded entirely, we cannot guarantee full agreement.

However, the data in this manual are reviewed regularly. Necessary corrections are included in

subsequent editions. Suggestions for improvement are welcomed.

Copyright

© Siemens AG 2006. All rights reserved

The reproduction, transmission or use of this document or its contents is not permitted without

express written authority. Offenders will be liable for damages. All rights, including rights created

by patent grant or registration of a utility model or design, are reserved.

All product and system names are registered trademarks of their respective owner and must be

treated as such.

Technical data subject to change.


This manual will be updated as required. You can find the current version of the manual on the Internet at

http://www.siemens.com/comdec.

Guide To help you quickly find the information you need, this manual contains the following aids: o A complete table of contents as well as a list of all figures and tables in the manual are provided at the

beginning of the manual.

o A glossary containing definitions of important terms used in the manual is located following the appendices.

o References to other documents are indicated by the document reference number enclosed in slashes (/No./). The complete title of the document can be obtained from the list of references at the end of the manual.

Additional Support If you have questions regarding use of the described block that are not addressed in the documentation, please contact your Siemens representative.

Please send your written questions, comments, and suggestions regarding the manual to the hotline via the e-mail address indicated above.

In addition, you can receive general information, current product information, FAQs, and downloads pertaining to your application on the Internet at:

HUhttp://www.siemens.com/comdecUUH

Technical Contacts for Germany / Worldwide

Siemens AG

Automation & Drives

ComDeC

Phone: 0911/750-2736 Phone: 0911/750-2080 Fax: 0911/750-2100 E-mail: [email protected]

Street address:

Würzburgerstr.121

90766 Fürth Federal Republic of Germany

Mailing address:

P.O. Box 2355

90713 Fürth Federal Republic of Germany

Technical Contacts for USA

PROFI Interface Center: One Internet Plaza PO Box 4991 Johnson City, TN 37602-4991

Fax: (423)- 262- 2103 Phone: (423)- 262- 2576 E-mail: [email protected]


Inhaltsverzeichnis

1 Introduction ............................................................................................................................6 1.1 ERTEC 200 Boot Modes ........................................................................................................................ 6 1.2 Resource Requirements for Boot Modes ............................................................................................... 7 1.3 Structure of Downloadable Image .......................................................................................................... 8

1.3.1 Image Type 1.................................................................................................................................... 8 1.3.2 Image Type 2.................................................................................................................................... 8 1.3.3 Structure of the Image Header ......................................................................................................... 9 1.3.4 Generation of an Images with Header .............................................................................................. 10

1.4 MPU initialisation of the ARM946 E-S Core ........................................................................................... 10 2 The Boot process ...................................................................................................................11

2.1 Boot start up........................................................................................................................................... 11 2.2 Boot from external NOR-Flash with 8-, 16- or 32-Bit Data Bus .............................................................. 11 2.3 PCI/LBU Boot Mode............................................................................................................................... 12

2.3.1 PCI Boot Mode ................................................................................................................................. 12 2.3.1.1 Semaphore 0 ............................................................................................................................ 14 2.3.1.2 Semaphore 1, 2 ........................................................................................................................ 14 2.3.1.3 Default PCI Bridge setting......................................................................................................... 15

2.3.2 LBU Boot Mode ................................................................................................................................ 16 2.4 SPI Boot Mode ....................................................................................................................................... 18 2.5 UART Boot Mode ................................................................................................................................... 21

3 Miscellaneous.........................................................................................................................24 3.1 Abbreviations:......................................................................................................................................... 24 3.2 References:............................................................................................................................................ 24


List of Figures

Figure 1: Required ressources for boot functions.................................................................................................... 7 Figure 2: Reserved communication RAM for different boot modes ......................................................................... 7 Figure 3: Structure of Image Type1 ......................................................................................................................... 8 Figure 4: Structure of Image Type2 ......................................................................................................................... 8 Figure 5: NOR-Flash Boot – Execution of Second Level Loader from Flash......................................................... 12 Figure 6: PCI Boot Mode ...................................................................................................................................... 13 Figure 7: LBU Boot Mode ...................................................................................................................................... 16 Figure 8: PCI/LBU Boot Process Flow Chart......................................................................................................... 17 Figure 9: SPI Boot Initialization.............................................................................................................................. 18 Figure 10: Firmware Download via SPI by Second-Level-Loader ......................................................................... 19 Figure 11: UART Boot Initialization........................................................................................................................ 21 Figure 12: Firmware Download via UART1 by Second-Level-Loader ................................................................... 22

List of Tables

Table 1: Supportes Download Modes for ERTEC 400 ............................................................................................ 6 Table 2: EMIF-Bus parameter settings .................................................................................................................... 9 Table 3: Initialization of MPU Regions................................................................................................................... 10 Table 4: Memory area for Semaphore................................................................................................................... 13 Table 5: Structure of Semaphore0......................................................................................................................... 14 Table 6: Structure of Semaphore1......................................................................................................................... 14 Table 7: Structure of Semaphore2......................................................................................................................... 14 Table 8: Internal Resources accessible via PCI .................................................................................................... 15 Table 9: PCI Bridge Initialization by Boot Loader .................................................................................................. 16 Table 10: SPI Register Configuration in SPI-Boot-Mode ....................................................................................... 19 Table 11: SPI-Protocol Configuration .................................................................................................................... 20 Table 12: GPIO’s Pin Function during SPI Boot Mode .......................................................................................... 20 Table 13: Register Configuration in UART1 Boot Mode ........................................................................................ 22 Table 14: UART-Protocol Configuration ................................................................................................................ 23 Table 15: GPIO Pin Function during UART-Boot-Mode ........................................................................................ 23


Revisions:

Version Nr. Date Information

1.0.0 07/2007 First version 1.0.1 07/2010 Register RES_CTRL_REG, SPI-Boot mode, PCI-Boot mode

1 Introduction

The ERTEC 400 device has a boot loader implemented in its 8 kByte boot ROM, that supports software downloads from different types of memory and via different interfaces. All required routines for download are programmed in the boot ROM. Selection of boot mode and source is done via the BOOT(2:0) pins of the ERTEC 400. The level at these pins is latched during the active reset phase and stored in the BOOT_REG register in the system control register area.

After the ARM946E-S CPU core within ERTEC 400 has started operation, the content of the BOOT_REG register is interpreted and the core branches into the respective routine. After the download is completed, the execution of the downloaded functions is started.

The following events trigger the boot process:

• Hardware reset

• Watchdog reset

• Software reset by setting the XRES_SOFT bit in the reset control register (RES_CTRL_REG) in the system control register area

Caution: In case of a watchdog reset or software reset event the register "RES_CTRL_REG" will be reset to the default values. Workaround: After a watchdog reset or software reset event the configuration ("WD_RES_FREI" and "PULSE_DUR") of register "RES_CTRL_REG" has to be written again by the software.

1.1 ERTEC 200 Boot Modes

By applying pull-up and pull-down resistors to the pins BOOT[3:0] of the ERTEC 400, different boot modes can be selected. The boot pin settings and related download modes are summarized in Table 1.

BOOT[2] BOOT[1] BOOT[0] Selected download mode 0 0 0 Via external ROM/NOR flash with 8-bit width

0 0 1 Via external ROM/NOR flash with 16-bit width

0 1 0 Via external ROM/NOR flash with 32-bit width

1 0 1 SPI (e.g. for use with EEPROMs with serial interface) 1 1 0 UART1 (Bootstrap method)

1 1 1 LBU/PCI (from external Host) All other Reserved

Table 1: Supportes Download Modes for ERTEC 400

The various boot modes can be divided into two categories:

• Boot via an interface or peripheral bus SPI1, UART1, LBU/PCI

• Boot via external flash access via external memory interface using CS_PER0_N


1.2 Resource Requirements for Boot Modes

For the execution of the program functions in the boot ROM, different (memory) resources within ERTEC 400 are required. Data, that has been stored in these areas before a boot process is triggered, may be altered. Figure 1 illustrates the entirety of memory resources that are involved in the boot process. Depending on the selected mode, only a subset of these resources is actually used; this will then be explained in the subsequent chapters.

Figure 1: Required ressources for boot functions

In different boot modes, the communication RAM is used. Figure 2 illustrates, which portions of the communication RAM are used and for which purpose.

Figure 2: Reserved communication RAM for different boot modes


1.3 Structure of Downloadable Image

The selected boot mode determines the structure of the downloadable image. The subsequent chapters and figures explain briefly the various image types, their usage and their structures.

1.3.1 Image Type 1

A image type 1 consists of three basic portions:

• An image header with information for program identification, used address ranges and initialization values (header structure is explained in 1.3.3)

• A second level loader that represents a customer or application specific download program with a more flexible structure than the original on-chip boot loader

• The actual downloadable firmware

The image type1 is used in the following boot modes:

• Via external ROM/NOR flash with 8-bit width



• Via SPI1

• Via UART1

Figure 3: Structure of Image Type1

1.3.2 Image Type 2

A type 2 image; that is used in LBU/PCI boot mode, is characterized by the absence of the second level loader. In LBU/PCI boot mode, the host processor, that is mastering the LBU/PCI interface, directly copies the image header into the memory area of the boot loader. In this case the image header is mainly required for the firmware start address, to which the ERTEC 400 jumps after boot process completion.

Figure 4: Structure of Image Type2


1.3.3 Structure of the Image Header

The Image header is an automatically generated structure that contains following parameters: typedef struct // UWord = 4 byte unsigned { UWord magic; /* Image identification */ UWord version; /* Software Version */ UWord ro_base; /* Image$$RO$$Base */ UWord ro_limit; /* Image$$RO$$Limit */ UWord rw_base; /* Image$$RW$$Base */ UWord rw_limit; /* Image$$RW$$Limit */ UWord zi_base; /* Image$$ZI$$Base */ UWord zi_limit; /* Image$$ZI$$Limit */ UWord emif_bus; /* EMIF 0-3 Bus Size */ UWord chksum; /* Checksum */ } ImageHeader; In boot modes that utilize the communication SRAM, the image header is copied by the boot code to the communication SRAM start address 1010 0000H (see Figure 2). The magic number in the above structure is fixed to 5345 520AH – the ASCII code for “SER” with the hexadecimal equivalent for 10 appended. The image length parameter “size” can be calculated from other parameters given in the header as follows: size = (ro_limit – ro_base) + (rw_limit – rw_base) + (zi_limit – zi_base) The checksum parameter “chksum” that is part of the image header is calculated over header and image – except the value of the checksum itself. The result is then transformed to its one’s complement and entered into the “chksum” field of above structure. The minimum size of an image is 4 Bytes, because otherwise the checksum cannot be calculated and entered into the chksum field.

The parameter “emif_bus” specifies the bus width that is initialized in the external memory interface registers at addresses 7000 0000H to 7000 001CH for chip select signals CS_PER(3:0)_N; the relation between the fields of the “emif_bus” parameter and the actual settings is shown in Table 2.

emif_bus(31:0)

Entry emif_bus[31:24] (for CS_PER0_N)

emif_bus[23:16] (for CS_PER1_N)



08H 8-bit bus width 8-bit bus width 8-bit bus width 8-bit bus width



Table 2: EMIF-Bus parameter settings

All other entries will be interpreted as undefined and consequently the registers are not initialized and left untouched in their default setting. A detailed description of the function of the external memory interface registers can be found in the ERTEC 400 manual /1/ and /2/.


1.3.4 Generation of an Images with Header

The Tornado tool chain, that is used for ERTEC 400, does not generate images with header; so the image file generated by Tornado and the header structure must be glued together with a separate program. The program head_bin.exe, that can be found in the \BSP\ertec400sk subdirectory of the ERTEC 400 development kit CD, is used for this purpose.

Head_bin.exe is activated with the following sequence: head_bin <input.bin> <output.bin> <header.txt> The meaning of these parameters is as follows:

• input.bin: name of the binary input file (with or without second level loader) generated by Tornado tool chain

• output.bin: name of binary output file including header, checksum and original firmware

• header.txt: text file with the parameters to be entered in the structure shown above

Header.txt is generated by the Tornado tool chain under control of the header.tcl file (in the same directory); header.tcl extracts the required parameters from the VxWorks project and outputs them in the header.txt file, which is then used by head_bin.exe.

1.4 MPU initialisation of the ARM946 E-S Core

The ARM946E-S core that is used in ERTEC 400 has a memory protection unit (MPU) in order to partition and mutually protect the total available memory. This is achieved by the configuration of memory regions with specific access rights. The boot loader on ERTEC 400 performs a basic setting of memory regions that is summarized in Table 3.

Access right Region Base Size

privileged mode user mode I-Cache D-Cache

0 0x0000 0000 4 GByte RW RW no no

1 0x0000 0000 8 kByte RW RW yes no 4 0x4000 0000 8 kByte R R no no

Table 3: Initialization of MPU Regions

I-cache and D-cache are generally not enabled. Only if the semaphore control in LBU/PCI boot mode selects I-cache respectively D-cache usage, they are enabled.


2 The Boot process

The boot code is stored from address 4000 0000H onwards within the ERTEC 400 address range; within the boot code a version identification of the software is provided. The function (ulong)(*sw_versionfunc)(void) is

provided at address 4000 1648H in the boot code. At the time of preparation of this manual the value is 11; it may be incremented in future software versions.

2.1 Boot start up

During the active reset phase, the boot pins BOOT[2:0] are latched and stored in the BOOT_REG register in the system control register area. After ERTEC 400 has been reset, the boot ROM is mirrored down to address 0000 0000H. The ARM946E-S CPU core in ERTEC 400 will start boot code execution from this address onwards. The watchdog, all IRQ interrupts and the peripherals including the IRT switch are inactive during the boot start-up phase.

At first, the ARM946E-S CPU pre-initializes ERTEC 400 using the boot code. After this start up sequence has been executed, the boot loader will branch into the routine for the selected boot mode. Depending on the mode, image header, rw and zi data, semaphores, supervisor and abort stacks will be copied by the boot code either to the communication SRAM or to the D-TCM.

If the communication SRAM is used, the address range from 1010 0000H up to 1010 102FH is reserved for the boot loader. If an image header exists, it will be placed at address 1010 0000H onwards (see Figure 1). If the D-TCM is used instead, it is reserved completely for usage by the boot code.

The processing after the start up phase is determined by the selected boot mode; the different alternatives will be described throughout the subsequent chapters.

2.2 Boot from external NOR-Flash with 8-, 16- or 32-Bit Data Bus

If one of these boot modes is used, the external Flash (for simplicity we will refer only to Flash memory from now on) memory must be connected to CS_PER0_N respectively to bank 0. The modes are typically used for applications, where the biggest part of the firmware is running on the ARM946E-S core of ERTEC 400. External SDRAM is required besides the Flash memory; for execution speed reasons, the firmware is copied to SDRAM by the boot loader and then executed from SDRAM.

After reset of ERTEC 400, the internal boot loader starts execution in the mirrored area of the boot ROM from address 0000 0000H. The boot loader then executes the following steps:

• Image header data is read from external flash.

• Header and image (ro and rw regions) are checked according to the checksum in the image header.

• The Async_BANK[3:0]_Config registers are initialized according to the “emif_bus” parameter.

• Copy ro, rw and zi regions of the second level loader according to the parameters (base, limit) in the image header to their target addresses. Target addresses can be in internal memories or external SRAM respectively SDRAM.

• Initialize the PCI bridge, if PCI operation has been selected with the configuration pins.

By proper selection of the ro_base parameter the code can either be executed in the external ROM/NOR Flash (“execute in place”) or in RAM. The entry address of the second level loader is the base address of the CS_PER0_N area plus the size of the image header.

The boot loader performs a remap of external Flash memory and the user RAM; then the boot loader terminates execution with a jump to the entry address of the second level loader. Now the second level loader takes over and continues the boot process with the following steps:

• Copy firmware from external Flash memory into RAM

• Start firmware in RAM


Figure 5: NOR-Flash Boot – Execution of Second Level Loader from Flash

If the Flash boot fails (for example due to a problem in the image header) the boot loader automatically branches into the PCI boot mode.

2.3 PCI/LBU Boot Mode

The ERTEC 400 has a PCI- and an LBU interface implemented; usage of these interfaces is mutually exclusive. Selection between the two types of interface is done with the CONFIG2 configuration pin as follows:

CONFIG2 = 0b: LBU interface is active CONFIG2 = 1b: PCI interface is active

So if the BOOT[2:0] pins are configured to LBU/PCI boot, the CONFIG2 pin setting decides which of the two interfaces will be used for the boot process and during subsequent operation of the device. In this document we will focus on PCI boot; the LBU boot works in a very similar manner so that we will simply describe the differences in Chapter 2.3.5.

2.3.1 PCI Boot Mode

When the PCI boot mode is used, the complete firmware is transferred under control of an external host, that is connected to the PCI interface of the ERTEC 400. By proper configuration of the PCI_Base_Address_Translation registers the external host gets access to internal resources of the ERTEC 400; the initialization values for these registers are listed in Table 9.

The boot loader reserves a portion of the Communication SRAM for the image header, stack, semaphores, rw and zi data; this portion covers the addresses from 1010 0000H to 1010 102FH. The last 16 Bytes of the reserved area are used for the semaphores.

The PCI boot process is executed in several steps that are explained below:

• The boot loader initializes the PCI bridge with the proper values to get access to internal resources of the ERTEC 400.

• After completion of the initialization, the boot loader sets semaphore 0 in the communication SRAM (see Figure 8).

• The PCI_Base_Adress_Translation registers (5:0) of the ERTEC 400 are initialized in such a way, that the external host has access to the communication SRAM and thus to semaphore 0.

• The external host waits for the transition of semaphore 0 from 0b to 1b before executing further accesses to the ERTEC 400.

• After the transition of semaphore 0b to 1b, the host configures the required memory ranges (SDRAM, EMIF bank 0 etc) in the respective external memory interface control registers.

• The host copies the header into the reserved area of the communication SRAM that is evaluated by the ARM946E-S core, after the firmware download is completed.


• The host copies the complete firmware into the respective memory areas.

• The host signals the completion of the copy process by releasing semaphore 0.

• The boot loader now evaluates the header information and executes the required settings and initializations.

Figure 6 illustrates an example for this process. The last activity of the boot loader is to jump into the firmware by using the image header parameter “ro_base” as entry address. This jump is either directed into the internal SRAM or the I-cache – depending on the semaphore control.

Figure 6: PCI Boot Mode

The host can as well load blocks of data into the locked I-cache or the D-TCM; this is done under the control of three semaphores. The activation of D-TCM and locked I-cache is achieved with control bits in semaphore 1; if these areas are activated, the boot loader copies two blocks of data from the source area into I-cache and/or D-TCM of the ARM946E-S CPU. The data blocks to be copied are specified in semaphores 2 and 3. In this case the boot loader will superpose a portion of the mirrored SDRAM with an I-cache block, whose size is specified in semaphore 2. Additionally an arbitrary block of memory will be superposed with the 4 kBytes of D-TCM as shown in Table 6.

It is recommended to use the I-cache for the vector table to achieve fast interrupt processing. The D-TCM however should be used for the stacks of other time-critical routines.

The PCI boot mode uses a total of three semaphores that are stored in the upper 16 Bytes of the reserved area in the communication SRAM. An overview of the semaphores is given in Table 4.

Semaphore Address Function

0 1010 1020H Handshake

1 1010 1024H Copy to D-TCM and/or I-cache

2 1010 1028H I-cache size

3 1010 102CH Unused

Table 4: Memory area for Semaphore


2.3.1.1 Semaphore 0

Semaphore 0 is used for handshaking between the host processor and the ARM946E-S CPU core. A 0b in bit 0 of semaphore 0 signals that the ARM946E-S CPU core controls the local (i.e. on-chip) resources; a 1b in bit 0 of semaphore 0 releases the on-chip resources of the ERTEC 200 to the external host processor.

Bitposition Semaphore 0 R/W Function

[0] R/W

Handshake ARM946E-S / Host

0 ARM946E-S has access to ERTEC400 local resources

1 external Host has access to ERTEC400 local resources

[31:1] R/W not used

Table 5: Structure of Semaphore0

2.3.1.2 Semaphore 1, 2

Semaphores 1 and 2 are used to control additional copy processes into the D-TCM and the I-cache. The copy process affects the first 12 kBytes of the firmware from the user RAM.: The first 8 kBytes are copied into the I-cache, the next 4 kBytes into the D-TCM. The target address, to which the D-TCM is subsequently mapped, is stored in the upper bits of semaphore 1; the target address can be specified in multiples of 4 kBytes in the complete 4 GBytes address space of ERTEC 400. I-cache and D-TCM can be initialized independently of each other using bit 0 and 1 of semaphore 0; the I-cache is locked by setting bit 2 in semaphore 1. The tables below give a detailed picture of semaphores 1 and 2.


[0] R/W

Decides if a portion of the I-cache is initialized with memory content from the source/target address specified in semaphore 2.

0 I-cache is not initialized and enabled

1 I-cache is initialized as described above and enabled

[1] R/W

Decides if the D-TCM is initialized with memory content from the source address specified in semaphore 3 and mapped to the target address specified in bit(31:12) of semaphore 1.

0 D-TCM is not initialized and enabled

1 D-TCM is initialized as described above and enabled

[2] R/W

Decides if the I-cache is locked after being initialized with first 8 kBytes from the user RAM.

0 I-Cache is not locked

1 I-Cache is locked [11:3] R/W not used

[31:12] R/W Target address to which the D-TCM is mapped, given in multiples of 4 kBytes.



[7:0] R/W

Size of initialized and locked I-cache portion

2h 2 kByte I-cache portion

4h 4 kByte I-cache portion

others Reserved [31:8] R/W not used



2.3.1.3 Default PCI Bridge setting

The download of the firmware is done under the control of an external PCI host. In order to give this external host a meaningful access to the internal resources of the ERTEC 400, the boot loader executes a default initialization of the PCI bridge. Table 8 summarizes the resources that the external PCI host can access.

Window AHB address offset

Size Resource Comment

PCI-BAR0 7000 0000H 64 kBytes EMIF registers Control registers for external memory interface

PCI-BAR1 4000 0000H 64 kBytes Boot ROM and APB peripherals

8 kBytes internal boot ROM

PCI-BAR2 6000 0000H 64 kBytes internal SRAM 8 kBytes internal SRAM

PCI-BAR3 1000 0000H 8 MBytes IRT switch

PCI-BAR4 3000 0000H 16 MBytes EMIF bank 0 Memory of peripheral that is connected to CS_PER0_N

PCI-BAR5 2000 0000H 32 MBytes SDRAM External SDRAM bank

Table 8: Internal Resources accessible via PCI

To allow the ERTEC 400 access to its PCI bridge, the Clk_Ctrl bit in the CLK_CTRL_REG register is set to 1b. Then the boot loader sets configuration registers in the PCI bridge as shown in Table 9. The address offset for the registers in Table 9 is 8000 0000H. The area is not enabled for PCI master accesses by the boot loader; if desired this needs to be done individually by the firmware.

Address Register Initialization value

Comment

8000 0050H PCI_Base_Address_Mask_ Register0

FFFF 0000H 64 kBytes window size, non-prefetchable


FFFF 0000H 64 kBytes window size, non-prefetchable


FFFF 0008H 64 kBytes window size, prefetchable

8000 005CH PCI_Base_Address_Mask_ Register3

FF80 0008H 8 MBytes window size, prefetchable


FF00 0008H 16 MBytes window size, prefetchable


FE00 0008H 32 MBytes window size, prefetchable

8000 0068H PCI_Base_Address_Translation_ Register0

7000 0000H EMIF registers

8000 006CH PCI_Base_Address_Translation_ Register1

4000 0000H APB peripherals


6000 0000H internal SRAM


1000 0000H IRT switch


3000 0000H external memory bank 0 (CS_PER0_N)

8000 007CH PCI_Base_Address_Translation_ Register5

2000 0000H external SDRAM

8000 0090H AHB_Base_Address_Register0 8000 0000H Base address of AHB space

8000 0040H Vendor_ID 110AH “Siemens AG”

8000 0042H Device_ID 4026H “ERTEC 400”

8000 0044H Subsystem_Vendor_ID 0001H “A&D PT2”

8000 0046H Subsystem_ID 0001H “FSE-PCI”

8000 0084H INT_Pin 0100H INTA


8000 0086H Max_Lat / Min_Gnt 0000H No special Max_Lat / Min_Gnt requirements

8000 008AH PM_Capability 7E0AH Supports D0, D1, D2

8000 008CH Revision ID 01H first revision

8000 008DH Class_Code 02 0000H Ethernet device

8000 00CCH AHB_Function_Register 0002H Validates AHB address mapping register

8000 00CEH AHB_Status_Register 003FH Resets the status register

8000 00D0H Wait States 0707 0F07H 15 wait states for bridge as AHB slave, 7 wait states for all others

8000 00D8H AHB_Interrupt_Enable_Register 003F F900H All bridge interrupts enabled

8000 00DCH PCI_Interrupt_Enable_Register 0000 0001H PCI interrupt INTA enabled

8000 00FCH Enable_Configuration_From_PCI 00H Configuration from AHB side completed; PCI master takes over control

Table 9: PCI Bridge Initialization by Boot Loader

Caution: Under very rare conditions, in PCI-boot mode, it is possible that the interrupt bit 4 "INT_QVZ_PCI_STATE " in register "PLL_STAT_REG" will be left "on" after finishing the 1st level boot. Workaround: To avoid irritations concerning the interrupt causes it is recommended to reset interrupt bit 4 "INT_QVZ_PCI_STATE" in register "PLL_STAT_REG" at the beginning of 2nd level boot code.

2.3.2 LBU Boot Mode

When the LBU boot mode is used, the complete firmware is transferred under the control of an external host that is connected to the LBU interface of the ERTEC 400. The external host initializes the LBU registers to get proper access to the internal resources of the ERTEC 400. The rest of the boot process with the semaphore control and the firmware download corresponds exactly to the description of the PCI boot mode. Figure 7 illustrates the principle.

Figure 7: LBU Boot Mode


Figure 8: PCI/LBU Boot Process Flow Chart

Note: 1. Memory and Semaphores are undefined for a short time. The memory area that is reserved for the image

header is initialized with 0b. 2. Semaphore 0 is set to 1b after app. 10 ms (with 150 MHz CPU clock). 3. ARM946E-S hands over the boot activity to the external host that has been waiting in its loop. 4. External host has downloaded firmware and image header and releases the ARM946E-S core from its wait

loop.

Caution: Make sure by your hard- and software design that the external host does not test semaphore 0 before it has actually been initialized by the ERTEC 400 or before a reset of the PCI-bridge has taken place.


2.4 SPI Boot Mode

If the SPI boot mode is used, the second level loader and the firmware are copied from a serial Flash memory or a serial EEPROM under control of the built-in boot loader. To download the code, the boot loader executes the following steps:

• Configuration of the SPI interface.

• Copy of the image header from the SPI device into a reserved area of the communication SRAM.

• Initialize the external memory interface control registers according to the parameters in the image header.

• Copy of the second level loader into SDRAM according to the parameters in the image header.

Figure 9 visualizes the status before execution of the boot loader respectively the second level loader.

Figure 9: SPI Boot Initialization

After reset, the boot loader jumps into the mirrored boot loader above address 4000 0000H and mirrors the internal user RAM to address 0000 0000H. The boot loader then hands execution over to the second level loader. The target address for the image of the second level loader is given by the parameter “ro_base” in the image header. Target addresses must be RAM addresses. In order to illustrate the function of the second level loader, a more “diversified” firmware download from an SPI device is shown in Figure 10. The second level loader copies several segments of a firmware via the SPI interface into the target memory areas like SDRAM, external SRAM connected to CS_PER0_N and the communication SRAM. After the download is completed, the second level loader starts the firmware execution.


Figure 10: Firmware Download via SPI by Second-Level-Loader

The SPI boot mode uses GPIO23 as an input pin to select between SPI-compatible EEPROMs and SPI-compatible serial data Flash memories as boot medium.

GPIO23 = 0b: SPI-compatible data Flash GPIO23 = 1b: SPI-compatible EEPROM

The main difference between the memory types can be found in the opcodes for read accesses. The SPI-compatible memory device must have a minimum size of 4 kBytes and must support the MOTOROLA SPI format. GPIO22 is used as an output to drive the CS_N input of the memory device. When the SPI boot mode is selected, the boot loader performs register initializations that are summarized in Table

10:

Register Value Remark GPIO_PORT_MODE_H 0x0000 455A Signal GPIO18-21,23 mode SPI (function 1)

GPIO 16-17 are set to function 2 GPIO 22 CPU Chipselect SPI (normal I/O function)

GPIO_IOCTRL 0xFFA7 FFFF GPIO 19, 20, 22 are set to Output; All other GPIOs are set to Input

SSPCR0 0x3D07 SCR=0x3D FRF = 0x00 SPH = 0x00 SPO = 0x00 DSS = 0x07

Frame Format :

clock devision factor = 61 Motorola SPI Format Serial clock rate Frame format Datasize 8 bit

SSPCR1 0x0010 Master, enable

SSPCPSR 0x0002 CPSDVSR field of prescaler for serial data clock set to 2

Table 10: SPI Register Configuration in SPI-Boot-Mode


The fields FRF, SPH, SPO and DSS in the SSPCR0 register specify the data format that is used when data is read out of the serial EEPROM respectively the serial data flash. Table 11 illustrates the meaning of the various fields within the SSPCR0 register.

SSPCR0 bits Field name Setting Function

15:8 SCR 3DH Parameter for serial clock division, set to 61

7 SPH 0H Received MSB is expected immediately after falling edge of SPI1-SFRMOUT

6 SPO 0H Received bits are latched on the rising edge of the SPI1-SCLKOUT signal

5:4 FRF 0H Use Motorola SPI frame format

3:1 DSS 7H Use 8-bit data words

Table 11: SPI-Protocol Configuration

The bitrate, that is used for the download of data from serial EEPROM or Flash is given by the following formula:

BR = 50 MHz /(CPSDVSR x (1 + SCR))

This results in a bit rate of pp. 400 kbps. Finally, Table 12 shows the GPIO configuration that is set with the GPIO_PORT_MODE_H and GPIO_IOCTRL register settings for the SPI boot mode.

Nr. Signalname SSP Function GPIO In/ Out

17 GPIO16 SSPCTLOE (not used) In 18 GPIO17 SSPOE (not used) In 19 GPIO18 SSPRXD In

20 GPIO19 SSPTXD Out 21 GPIO20 SCLKOUT Out

22 GPIO21 SFRMOUT (not used) In

23 GPIO22 SPI-Chip Select for serial memory device

using normal GPIO function GPIO Out

24 GPIO23 Serial EEPROM or Flash selection using

normal GPIO function GPIO-In

Table 12: GPIO’s Pin Function during SPI Boot Mode

Note: Only the GPIO pins in shaded areas are actually used during the SPI boot process. Caution: If an image, that is booted via SPI interface, does not contain any Read-Write data (i.e. only Read-Only data), the checksum is not calculated properly and the image is not started. Workaround: Define at least one global variable so that the image always contains Read-Write data.


2.5 UART Boot Mode

If the UART boot mode is used, the boot loader executes the following steps in order to download the code:

• Configuration of the UART1 interface.

• Copy of the image header via the UART1 interface into a reserved area of the communication SRAM.

• Initialize the external memory interface control registers according to the parameters in the image header.

• Copy of the second level loader into SDRAM according to the parameters in the image header.

Figure 11 visualizes the status before and after execution of the boot loader.

Figure 11: UART Boot Initialization

After reset, the boot loader jumps into to mirrored boot loader above address 4000 0000H and mirrors the internal user RAM to address 0000 0000H. The boot loader then hands execution over to the second level loader. The target address for the image of the second level loader is given by the parameter “ro_base” in the image header. Target addresses must be RAM addresses.


Figure 12: Firmware Download via UART1 by Second-Level-Loader

The second level loader may copy several segments of a firmware via the UART1 interface into the target memory areas like SDRAM, external SRAM connected to CS_PER0_N and the communication SRAM. After the download is completed, the second level loader starts the firmware.

When the UART boot mode is selected, the boot loader performs register initializations that are summarized in Table 13:

Register Value Remark GPIO_PORT_MODE_L 0x0155 0000 GPIO8 -12 are set to function 1 = UART;

GPIO 0 – 7 and GPIO 13 – 15 are set to normal I/O function

GPIO_IOCTRL 0xFFFF FEFF GPIO 8 is set to Output; all other are set to Input

UARTLCR_H 0x60 8Bit Data, 1Stop bit, no parity, no FIFO

UARTLCR_M 0x00 UARTLCR_L 0x1A

Baud ratew devisor is set to 26

UARTCR 0x31 Enables the UART as well as receive and transmit interrupts

Table 13: Register Configuration in UART1 Boot Mode


The fields WLEN, FEN, STP2, EPS; PEN and BRK in the UARTLCR_H1 register specify the protocol that is used when data is transferred via the UART interface. Table 14 illustrates the meaning of the various fields within the UARTLCR_H register.

UARTLCR_H bits Field name Setting Function

6:5 WLEN 3H Use 8-bit data

4 FEN 0H FIFO disable

3 STP2 0H Insert one stop bit

2 EPS 0H Irrelevant due to PEN = 0H

1 PEN 0H Parity disabled

0 BRK 0H Do not sent break

Table 14: UART-Protocol Configuration

The bitrate that is used for the download of data via the UART is given by the following formula:

BR = (50 MHz /(BAUDDIVLS x 16))-1 A baud rate divider of BAUDDIVLS = 26 results in a bit rate of 115200 bps. Finally, Table 15 shows the GPIO configuration that is set with the GPIO_PORT_MODE_L and GPIO_IOCTRL register settings from Table 15 for UART boot mode.

Nr. Signalname UART Funktion GPIO In/ Out 9 GPIO8 UART_TXD Out

10 GPIO9 UART_RXD In 11 GPIO10 UART_DCD_N In

12 GPIO11 UART_DSR_N In 13 GPIO12 UART_CTS_N In

Table 15: GPIO Pin Function during UART-Boot-Mode

Note: Though GPIO(12:10) are configured as UART handshake signals the UART operates with software flow control; the UART host does not need to operate the handshake signals. So only GPIO(9:8) are actually used during the UART Boot process.


3 Miscellaneous

3.1 Abbreviations:

AHB Advanced Highperformance Bus (Multimaster, Bursts) APB Advanced Peripheral Bus (Singlemaster, Bursts) CRC Cyclic Redundancy Check D-TCM Data Tightly Coupled Memory ERTEC Enhanced Real-Time Ethernet Controller EMIF External Memory Interface GPIO General Purpose Input/Output IRQ Interrupt Request IRT Isochrones Real Time LBU Local Bus Unit RO Read Only RW Read Write SCRB System Control Register Block SDRAM Synchronous Dynamic RAM SPI Standard Serial Peripheral Interface SRAM Static RAM UART Universal Asynchronous Receiver / Transmitter ZI Zero Init 2LL Second Level Loader

3.2 References:

/1/ ERTEC 400 Manual V1.2.0 (ERTEC400_Manual_V120.PDF); /2/ ERTEC 400 Datasheet V1.2.0 (ERTEC400_Datasheet_V120.PDF); /3/ ERTEC400_ERRATA_EN.PDF /4/ ERTEC_ARM_ERRATA_INFO.PDF

ertec400 boot manual v101 - siemens · 2015-01-20 · the checksum parameter “chksum” that is...

Documents