对于Freescale MFG编程工具控制文件ucl.xml的分析
为了将映像文件烧进NANDFlash中，我必须要分析ucl.xml文件，并能自己照着画一个符合项目要求的。唉。
分析的时候需要参考MFG的工具提供的Document：《Manufacturing Tool UCL usermanual.doc》
找到<LISTname=”MX53SMD-Android-eMMC4.4” 这一条，开始分析了：
首先有一段注释意思是：该条目用于将Android编程到eMMC4.4存储设备上。如果使用默认设置请不要插入SD卡。如果插入了SD卡，eMMC4.4的块号码就变成1了。
噢，此处我明白了，为什么要mmc read 1，而不是mmc read 0。
1、<CMD type=”boot” body=”BootStrap” file=”u-boot-mx53-smd.bin”>Readfrom DDR script from u-boot to init DDR memory.</CMD>
这一条的注释奇怪啊。搞不明白什么意思。这条命令应该是下载uboot.bin文件到内存中。不过从手册中并没有发现boot和BootStrap可以一起使用啊。奇怪！
2、<CMD type=”load” file=”uImage” address=”0x70800000” loadSection=”OTH”setSection=”OTH” HasFlashHeader=”FALSE”> Doing Kernel.</CMD>
这条的意思就是下载uImage文件到内存的0x70800000地址处。
3、<CMD type=”load” file=”initramfs.cpio.gz.uboot” address=”0x70B00000”loadSection=”OTH” setSection=”OTH” HasFlashHeader=”FALSE”>DoingInitramfs.</CMD>
这条的意思是下载initramfs.cpio.uz.uboot文件到内存的0x70B00000地址处。
4、<CMD type=”jump”>Jumping to OS image.</CMD>
这条看来是通知内嵌ROM代码跳转到内存中的映像执行。但是跳到哪里呢？跳到uboot?跳到kernel还是rootfs？此处不明白？
5、<CMD type=”find” body=’Updater” timeout=”180/>
这条是在180秒内导找处于引导模式的设备。
6、<CMD type=”push” body=”mknod block,mmcblk0,/dev/mmcblk0,block”/>
因为命令类型为push，所以此句在目标机上执行。感觉这句是创建设备节点。目标机的linux系统运行起来了吗？
7、<CMDtype="push" body="$ mknod /dev/zero c 1 5">Create zerodevice node</CMD>
这句是在目标机上创建zero字符设备
8、<CMDtype="push" body="$ dd if=/dev/zero of=/dev/mmcblk0 bs=512seek=1536 count=16">clean up u-boot parameter</CMD>
从意思上来看是清除uboot参数，即将/dev/mmcblk0从1536地址开始共计16个字节的信息清零。
这句话的具体意思还不明确，查一下dd的用法，为什么偏移是1536?估计还是跟NandFlash分区有关系！
9、<CMDtype="push" body="send"file="mksdcard-android.sh.tar">Sending partition shell</CMD>
这句将本机的脚本发送到目标机
10、<CMDtype="push" body="$ tar xf $FILE ">Partitioning...</CMD>
解压文件
11、<CMDtype="push" body="$ sh mksdcard-android.sh/dev/mmcblk0"> Partitioning...</CMD>
执行脚本文件
12、<CMDtype="push" body="$ mknod /dev/mmcblk0p1 b 179 1"/>
<CMD type="push"body="$ mknod /dev/mmcblk0p2 b 179 2"/>
<CMD type="push"body="$ mknod /dev/mmcblk0p3 b 179 3"/>
<CMD type="push"body="$ mknod /dev/mmcblk0p4 b 179 4"/>
<CMD type="push"body="$ mknod /dev/mmcblk0p5 b 179 5"/>
<CMD type="push"body="$ mknod /dev/mmcblk0p6 b 179 6"/>
创建块设备文件，为什么要创建6个？难道NANDFlash被分了6个分区？
13、<CMD type="push" body="$ echo 1> /sys/devices/platform/mxsdhci.2/mmc_host/mmc2/mmc2:0001/boot_config">accessboot partition 1</CMD>
有一句注释：如果只是为了烧录bootloader则可以注释掉这一行。
14、<CMDtype="push" body="send"file="files/android/u-boot.bin">Sending U-Boot</CMD>
将uboot发送到目标机。现在看来，是先在目标机的内存里运行一个ramfs的微内核，这个微操作系统里面包括一些诸如NAND驱动什么的。用于支持烧录操作。哈哈。现在开始才是烧录我们自己的uboot啊。
15、<CMD type="push" body="$ ddif=/dev/zero of=/dev/mmcblk0 bs=512 seek=2 count=2000">Clean U-Bootenvironment</CMD>
清除uboot环境信息，说白了就是擦除NANDFlash.
16、<CMD type="push" body="$ ddif=$FILE of=/dev/mmcblk0 bs=512 seek=2 skip=2">write U-Boot to sdcard</CMD>
将刚才发送过来的uboot烧写进NandFlash.
17、<CMD type="push" body="$ echo8 >/sys/devices/platform/mxsdhci.2/mmc_host/mmc2/mmc2:0001/boot_config">accessuser partition,and enable boot partion1 to boot</CMD>
<CMD type="push" body="$ echo 2> /sys/devices/platform/mxsdhci.2/mmc_host/mmc2/mmc2:0001/boot_bus_config">Setboot width is 8bits</CMD>
这些比较奇怪，好像是使能启动选项。有一个注释说：如果只烧bootloader的话可以注释掉这两行。
18、<CMD type="push"body="send" file="files/android/uImage">Sending kerneluImage</CMD>
这句的意思是将uImage发送到目标机
19、<CMD type="push" body="$ ddif=$FILE of=/dev/mmcblk0 bs=512 seek=2048">write kernel image to sdcard</CMD>
将内核文件写到nandflash中。从开始处偏移2048个字节（2MB）开始写。
20、<CMD type="push"body="send" file="files/android/uramdisk.img">Sendingkernel uImage</CMD>
将ramdisk发送到目标机
21、<CMD type="push" body="$ ddif=$FILE of=/dev/mmcblk0 bs=6M seek=1">write kernel image to sdcard</CMD>
将ramdisk写到nandflash中，以6MB的单位偏移1个单位。
22、<CMD type="push" body="$mkfs.vfat /dev/mmcblk0p1">Formatting sd partition</CMD>
将目标nandflash的第一个分区格式化成vfat文件系统
23、<CMD type="push" body="$mkfs.ext4 /dev/mmcblk0p2">Formatting system partition</CMD>
将目标nandflash的第二个分区格式化成ext4文件系统
24、<CMD type="push" body="$mkfs.ext4 -O^extent /dev/mmcblk0p4">Formatting recoverypartition</CMD>
<CMD type="push"body="$ mkfs.ext4 /dev/mmcblk0p5">Formatting datapartition</CMD>
<CMD type="push"body="$ mkfs.ext4 -O^extent /dev/mmcblk0p6">Formatting cachepartition</CMD>
这些都是执行一些分区格式化操作。
-O^extent 这句什么意思不清楚？
25、<CMD type="push" body="pipedd of=/dev/mmcblk0p2 bs=512" file="files/android/system.img">Sendingand writting system.img</CMD>
利用pipe传输大数据文件。将system.img写到第二分区中。
26、<CMD type="push" body="pipedd of=/dev/mmcblk0p4 bs=512"file="files/android/recovery.img">Sending and writtingsystem.img</CMD>
利用pipe传输大数据文件。将recovery.imag写到第四分区中。
27、<CMD type="push"body="frf">Finishing rootfs write</CMD>
执行flush刷新操作，等待所有数据传输完毕
28、<CMD type="push" body="$ echoUpdate Complete!">Done</CMD>
显示执行完毕信息
以上就是烧录固件时所有的命令，以下做一下总结：
1、下载uboot.bin到目标机内存，应该是内存地址0x0处
2、下载uImage到目标机内存，内存地址是0x70800000
3、下载initramfs到目标机内存，内存地址是0x70B00000
4、利用以上下载的文件在目标机的内存中运行起一个简易的操作系统
5、通过向目标机发送命令在目标机上创建设备节点，用于对nand flash进行操作
6、向目标机发送脚本文件执行nand flash分区操作
7、向目标机发送uboot.bin(这次是自己编译的需要烧写的)并烧写进nand flash中。
8、向目标机发送uImage（这里是自己编译的需要烧写的）并烧写进nand flash中。
9、向目标机发送ramdisk(这里是自己编译的需要烧写的）并烧写进nand flash中。
10、刷新操作flush
11、烧录结束
从文件分析上来看就是这样，但我觉得真够复杂的，freescale搞了个非常复杂的东东。唉。真应该跟人家三星学学，直接使用工具烧写nandflash多简单啊。无语了。
既然分析完了，下一步就是编写自己的控制文件，来烧录自己的程序啦。
Manufacturing(Mfg) tool provides a quite flexible way for users to set their own operations.An xml script file is used to configure the users operation.
An xml filetypically consists of a number of tasks which can be executed by runningmanufacturing tool just one time.
1 UTP mode operation 串行传输协议，我们使用这种方法烧录
1.1 Global
Configuration
Mfg tool uses global configuration to recognizewhich device is what user want to flash among a lot of USB devices connected toPC.
因为MFG工具同时支持4个USB口烧录，这里指定了USB端口的VID/PID信息，由用户通过GUI操作生成，不需要手工修改。
Let’s explain it by an example.
<CFG>
<STATE name="BootStrap" dev="MX51" />
<DEV name="MX51" vid="15A2"pid="0041"/> 定义i.mx5 USB口的VID/PID
<STATE name="Updater" dev="Updater" /> 定义升级模式不能修改
<DEV name="Updater" vid="066F"pid="37FF" />
</CFG>
Global configuration is contained betweenparameter <CFG> and </CFG>.
<STATE name="BootStrap"dev="MX51" /> is used to define ROM code running mode for targeteddevice. You can change "MX51" to any name you want.
<DEV name="MX51"vid="15A2" pid="0041"/> is used to specify USB deviceVID and PID of the device defined in the dev section of <STAT name=>sentence. The two dev names MUST be same.
<STATE name="Updater" dev="Updater" /> is used todefine updater mode, it should be never be changed.
<DEV name="Updater" vid="066F"pid="37FF" /> is used to specify USB MSC device VID and PID fortargeted device.
1.2 Update Command List
The tool uses Update Command List (UCL) tospecify all the user tasks. The UCL contains a distinct list for each use case.Each list contains a set of command elements with attributes for the commandtype, body and payload.
The command element text provides a user interfacemessage for the current operation.
Each UCL begins from <LIST name=”xx”,desc=”xxx”> while ending with </LIST>, wherein name can be specifiedby users. Parameter “desc” is used for comment purpose.
每一条更新命令列表如下列开始
<LISTname=”名字”,desc=”备注信息”>
</LIST>
There are two types of commands: hostspecific commands and firmware specific commands. Host specific commands areparsed and executed by host tool while firmware specific commands are parsedand executed by firmware runs
on targeted device.
有两种命令：
1、 主机特定命令，由主机MFG工具执行
2、固件特定命令，由目标机执行
1.2.1 Host specific commands
Below example shows a typical command.
“CMD type” specifies the type of a command.指定命令类型
“body” is a parameter of the command.命令的参数
“file”is another parameter. 命令的别一个参数
“Booting update client engine.” isdescription of the command. 命令的描述，随意写。
<CMD type="boot" body="Recovery"file="uce.sb" if="HabDisable">Booting update clientengine.</CMD>
|
Command type
|
Body
|
Other parameters
|
Description
|
|
find
|
BootStrap /Updater
|
timeout
|
Find the device which is under specified mode. The value of parameter “body” is the very one defined in STATE section of Global Configuration.
寻找处于引导模式的设备。因为MFG同时支持4个USB下载，所以利用该命令，可找到当前处于下载模式的设备。
|
|
init
|
Memory
|
file
|
Initialize RAM memory which is used to store the mini-OS sent from host.
file: specify the path and name of the file which contains memory initialization setting according to the memory type of the targeted hardware uses.
The format of the file must follow the example provided in release package.
The command is only for Bulk-IO mode i.MX device except i.MX50 HID mode device.
|
|
load
|
|
file
Address
loadSection
setSection
HasFlashHeader
CodeOffset
|
Download an image to RAM. It is strongly recommended to follow the example provided in release package since it involves ROM code parameters which is not easy to understand.
file: specify the path and name of the image file.
指定映像文件的路径和名称
Parameter “address” specifies the RAM address where image locates. 映像在内存中的位置
loadSection: a parameter used by ROM code, should be set to “OTH” ROM代码的一个参数，应该设置为OTH(other)
setSection: a parameter used by ROM code, should be set to “OTH” if there are other images to be loaded; set to “APP” if the last image is loaded.
如果还有其他映像的话，设置为OTH，如果是最后一个映像了则设置为APP，用于通知ROM代码，下载结束了。
HasFlashHeader: set TRUE if the image contains a flash header, or set to FALSE.
CodeOffset: the address offset of first executed instruct within the image.
The command is only for Bulk-IO mode i.MX device except i.MX50 HID mode device.
|
|
jump
|
|
|
Notify ROM code to jump to the RAM image to run. The command must be followed after a load command in which setSection value is set to “APP”.
通知ROM代码跳至内存处执行，通过在APP指令之后。
The command is only for Bulk-IO mode i.MX device except i.MX50 HID mode device.
|
|
boot
|
Recovery
|
File
if
|
Download an image to RAM.
下载映像到内存
|
1.2.1.1 i.MX28 Platform
There are two types of i.MX28 boards:Hab-Enable and Hab-Disable type. We have to distinguish them.
<CMDtype="boot" body="Recovery" file="uce.sb"if="HabDisable">Booting update client engine.</CMD>
The command downloads a RAMimage uce.sb to RAM if the board isHab-Disabled.
<CMDtype="boot" body="Recovery" file="uce_ivt.sb" if="HabEnable">Bootingupdate client engine.</CMD>
The command downloads a RAM image uce_ivt.sbto RAM if the board is Hab-Enabled.
<CMDtype="find" body="BootStrap" timeout="60"/>
The command searches the device which isunder boot strap mode within 60s.
1.2.1.2 i.MX23 Platform
<CMDtype="boot" body="Recovery" file="uce.sb" Bootingupdate client engine.</CMD>
The command downloads a RAM image uce.sbto RAM.
<CMDtype="find" body="BootStrap" timeout="60"/>
The command finds the device which isunder boot strap mode within 60s.
1.2.1.3 i.MX51 Platform
<CMDtype="find" body="BootStrap" timeout="60"/>
The command finds the device which isunder boot strap mode within 60s.
<CMDtype="init" body="Memory" file ="MX51_DDR.ddr.xml"/>
The command downloads file MX51_DDR.xmlto targeted device to perform memory initialization.
<CMDtype="load" file="uce.nb0" address="0x90200000"loadSection="OTH" setSection="OTH"HasFlashHeader="FALSE" >Doing preLoad."</CMD>
The command downloads a RAM image uce.nb0to RAM and will be stored in address 0x90200000.
<CMD type="load"file="eboot_uut.nb0" address="0x90040000"loadSection="OTH" setSection="APP"HasFlashHeader="FALSE" >Loading OS image.</CMD>
The command downloads a RAM image eboot_uut.nb0to RAM and will be stored in address 0x90040000.This is the last image to be loaded.
<CMDtype="load" file="eboot_uut.nb0"address="0x70041000" loadSection="OTH"setSection="APP" CodeOffset="0x800" >Loading OSimage.</CMD>
The command downloads a RAM image eboot_uut.nb0to RAM and will be stored in address 0x70041000. And the first executedinstruct is from the address offset “0x800” within the image. This is the lastimage to be loaded.
<CMDtype="jump" > Jumping to OS image. </CMD>
Till now, all the images are downloadedto RAM, and then notify ROM code to jump to the RAM image to run.
<CMDtype="find" body="Updater" timeout="180"/>
The command is used to find the devicewhich is under USB MSC mode within 180s.
1.2.1.4 i.MX50/53 Platform
<CMDtype="boot" body="Recovery" file ="eboot_uut.nb0">Running plugin to init LPDDR2 Memory.</CMD>
The command firstly downloads plugin (apart of eboot_uut.nb0) to iRAM to init RAM. Then it will download a RAM imageeboot_uut.nb0 to RAM and the stored address is calculated automatically.
<CMDtype="load" file="uce.nb0" address="0x70200000"loadSection="OTH" setSection="OTH">DoingpreLoad."</CMD>
The command downloads a RAM image uce.nb0to RAM and will be stored in address 0x70200000.
<CMDtype="jump" > Jumping to OS image. </CMD>
Till now, all the images are downloadedto RAM, and then notify ROM code to jump to the RAM image to run.
<CMDtype="find" body="Updater" timeout="180"/>
The command is used to find the devicewhich is under USB MSC mode within 180s.
Note: There may be some minor changesaccording to different platforms, but the functionality is similar.
All the above commands must be executedbefore doing any user task.
1.2.2 Firmware specific commands 固件指令
If a command is typed as “push”, whichmeans the command is parsed and executed by the targeted device instead of host,the only thing host has to do is to send the command to the targeted device.
当命令类型为push的时候，说明这条指令将被目标机解析并执行。
The commands actually executed by OSimage downloaded in Command
lists, as a result, each kind of OS has its owncommands.
1.2.2.1 WinCE OS
1.2.2.1.1 Specify
Media type
<CMDtype="push" body="MediaType:NAND">Send mediatype.</CMD>
Below commands show how to specify mediatype:
Here “NAND” is media type. For SD/MMCmedia, it should use “SDMMC” instead.
1.2.2.1.2 Check if a storage device is ready
Below two commands bothcan be used to check storage if ready.
<CMDtype="push" body="QueryStoreStatus:DSK1:,Timeout:10">Querystore status.</CMD>
The command specifies the name of a disk.
Here “DSKx:” indicates the storage devicehandle in WinCE OS, which must be 5 bytes long; If a different disk type needsto be specified, then just change “DSK1:” to “DSKx:”, wherein “x” is the indexof the storage device.
“Timeout” specifies the timeout value(second) for the query operation. In this example, query operation will quit ifthe specified device “DSK1:” can’t be found within 10 seconds.
<CMDtype="push" body="QueryStoreName:XXXX ,Timeout:10">Sendstore name.</CMD>
“XXXX” is the name of a storage devicesuch as “NAND FLASH Storage”. And it can be found in WinCE registry, belowregistry gives an example:
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash]
"Name"="NAND FLASHStorage"
It should be changed according to users’own registry setting.
“Timeout” specifies the timeout value(second) for the query operation. In this example, query operation will quit ifthe specified device “XXXX” can’t be found within 10 seconds.
To write a firmware or raw data to media,the either one of the two commands must be executed firstly. The command is notnecessary when you write the second firmware or raw data.
1.2.2.1.3 Create Partitions if the media type is
SD/MMC
Below commands show how to create partitions forSD/MMC media. Command1 is only for MX35/MX51 platform. And command2 is forMX23/MX28 platform.
<CMD type="push"body="Partitions:EBOOT:64MB,NK:32MB,File">Startingpartitions.</CMD>
<CMD type="push"body="Partitions:Firmware:100MB,File">Startingpartitions.</CMD>
Command1:Parameter”Partitions:EBOOT:XXMB,NK:XXMB,File”specifies SD/MMC card will be divided into three partitions. The firstpartition is for eboot
download, the second partition is for NK download, andthe File partition is used for user. “XX” means the partition size, and Filepartition size is remained size of SD/MMC card except for the size of EBOOT andNK partition.
Command2: Parameter”Partitions:Firmware:XXMB,File”specifies SD/MMC card will be divided into two partitions. But the firstpartition of SD/MMC is File
partition for user used. And the second partitionis for Firmware download. “XX” means the partition size, and File partitionsize is remained size of SD/MMC card except for the size of Firmware partition.
1.2.2.1.4 Flash a firmwareto media
Below a bench of commands show how toflash a firmware to media. If there are multiple firmwares to be written, thenthe whole bench of commands must be repeated.
<CMD type="push"body="wfw">Notity device to prepare receiving afirmware.</CMD>
<CMD type="push"body="fwtype:xxx">Specify firmware type.</CMD>
<CMD type="push"body="send" file="xxx">Sending a firmwarefile.</CMD>
<CMD type="push"body="save">write the firmware to NAND flash.</CMD>
Command1:Parameter”wfw” means writingfirmware.
Command2:Parameter”fwtype:xxx” specifiesthe name of a firmware. Here “xxx” is the name of firmware, there are five optionsused for the section: XL_NB, EB_NB, NK_NB, EB_SB, and NK_SB. And they supportthe different firmware
type show as below.
XL_NB is for xldr.nb0 type,
EB_NB is for eboot.nb0 type,
NK_NB is for nk.nb0 type,
EB_SB is for eboot.sb type,
NK_SB is for nk.sb type.
The image file name is specified inCommand 3 which will send data of the file to targeted device.
Command4 is used to notify targeteddevice to flash whole data into media.
1.2.2.1.5 Write raw data to media
Below a bench of commands show how to writeraw data to media. The commands can be used when you need to write raw datainto specified address of a media.
<CMD type="push"body="wrd:0x400">Write raw data to device with a specifiedstarting address.</CMD>
<CMD type="push"body="send" file="files/xldr.nb0">Sending afile.</CMD>
<CMD type="push"body="save">Finish sending data.</CMD>
Command 1: Write raw data to media. Thevalue of address to be written is specified along with the colon.
Command 2: Send data of the file whose nameand path are specified in keyword “file” to targeted device.
Command 3: Notify targeted device toflash whole data into media.
1.2.2.1.6 Check if a disk is ready
Before write a file to a disk, belowcommand must be executed.
<CMDtype="push" body="QueryFolderStatus:XXXX,Timeout:10">Queuefolder status.</CMD>
“XXXX” is the name of a disk such as “NANDFlash”.And it can be found in WinCE registry, below registry gives an example:
[HKEY_LOCAL_MACHINE\System\StorageManager\Profiles\MSFlash]
"Folder"="NANDFlash"
It should be changed according to users’own registry setting.
“Timeout” specifies the timeout value(second) for the query operation. In this example, query operation will quit ifthe specified disk “NANDFlash” can’t be found within 10 seconds.
To write a file to media, the commandmust be executed firstly. The command is not necessary when you write thesecond file.
1.2.2.1.7 Write a file to a disk
Below a bench of commands show how towrite a file to a disk. If there are multiple files to be written, then thewhole bench of commands must be repeated.
<CMD type="push"body="wfl">Notity device to prepare receiving a file.</CMD>
<CMD type="push"body="filename:xxx ">Sending file name.</CMD>
<CMD type="push"body="send" file=" xxx">Sending a file.</CMD>
<CMD type="push"body="save">Finish sending data.</CMD>
Command1:Parameter”wfl” means writing afile.
Command2:Parameter”filename:xxx”specifies the name and path of a file, xxx has to be replaced with user’s filename and path, for example:NANDFlash\\thriller.mp3.
The file name is specified in Command 3 whichwill send data of the file to targeted device.
Command4 is used to notify targeteddevice to write whole data into specified path.
1.2.2.1.8 OTP
bits programming
The functions are only available for i.MX233.
Below command shows how to write a file toa disk:
<CMDtype="push" body="OtpSendData:0x0000