Flashing Cavium Octeon Boards using Sourcery Probe

Document created by j.alsup on Nov 5, 2012Last modified by j.alsup on Nov 6, 2012
Version 2Show Document
  • View in full screen mode


The default built in Sourcery CodeBench Flash feature does not work with Cavium Octeon Boards.  To flash a Cavium Octeon board, you need to run an older flash utility, called

EPIFlash, as a target application under the control of the low level debugger MON.  This guide walks through the process of running this program.

NOTE: This document applies to the Sourcery CodeBench for MIPS ELF release 2012-09 and Mentor Embedded Sourcery Probe (MESP). It does apply to earlier versions of Sourcery CodeBench.


How it works

The Flash utility is a program that you need to download to and run on the target board to be flashed. It uses the semi-hosting feature of Sourcery CodeBench to do the following:

  1. Display flash configuration settings such as flash device type and base address
  2. Provide menus to control the flash settings and perform flash functions such as erase and program.
  3. Read the flash image (binary) file over JTAG when programming or verifying the image.
  4. Write the flash image to a file over JTAG when backing up the flash image to disk.



  • Since the EPIFlash utility runs from RAM on the target board, it must be possible to download it into RAM. Usually this means the memory controller must be initialized prior to running Target Flash. If your board has good working boot code, then it will perform this initialization. However, if there is no boot code (or bad boot code) then you may need to use the probe to initialize the memory controller. This is accomplished by running a board initialization script.
  • Before erasing the boot code on your board, make sure you have a suitable memory controller initialization script or it may be very difficult to get back to the point where you can install new boot code.
  • You must be using Sourcery CodeBench for MIPS Elf 2012.09 or newer.


Getting Started with EPIFlash

Running EPIFlash


Although the section above users a version of the flash utility as debug reference the package includes a version of the utility that runs with our low level command line debugger.  It’s very simple to startup and since the utilities UI is command line based it’s a better way to run it.  The steps are detailed below.




  1. Open a command shell and cd into the directory for your board:

    <install dir>/i686_mingw32/mips_sde/mep/tsp/mips/<cavium board>      (Windows)
    cd <install dir>/i686_pc_linux_gnu/mips_sde/mep/tsp/mips/<cavium board>  (Linux)

    Note that each Cavium board directory contains a flash configuration file setup for the particular Cavium board.  This file “epiflash3_be.cfg “ is read by the EPIFlash program at startup.

  2. To start the debugger simple issue the flash command in this directory:

    flash   (Windows)

  3. Some startup messages ensue including messages about scanning for probes.  Select you probe from the list and hit <enter> as shown below.  Note: if you probes is not found but it is setup on your network simply edit the flash.bat or flash shell script, change –dm to –d <probe ip addr> and it will auto connected to the referenced probe.

    Symbolic Assembly Level Debug Monitor, version V7.0.18 - Win32

    Copyright (c) 1987-2011 by Mentor Graphics Corporation - All Rights Reserved.

    Processing register file: ../../../bin\mips/spaces.rd

    Processing register file: ../../../bin\mips/cnmips.rd

    Reading command history from: 'C:\Users\jalsup\AppData\Roaming\mon_mon.hist'

    Scanning for visible Probes...

        Model:                   Serial #:      IP Addr:        UnitName:

    0: MESP-Pro / COP           FSL01E3B1   FSL01E3B1

                       Hostname: fsl01e3b1.ddns.sje.mentorg.com

    Select a Probe 0..0, q>

  4. After probe selection a connection is made to the probe and lots of startup messages ensue and at the end you are left at the MON debugger prompt.

    Establishing communications with probe: fsl01e3b1.ddns.sje.mentorg.com...

    Connection verified

    Processing register file: ../../../bin\mips\mds.rd

    MMU with 128 TLBs detected

    ICache = 64k (8 way, 128 b/l), DCache = 8k (64 way, 0 b/l), based on CONFIG1

    Notification from the target:

    FPU is not implemented CONFIG1.FP=0 CONFIG1=FE3703DA

    Target System:     MESP-Pro / MIPS, S/N FSL01E3B1

    Firmware Rev:      2.3.7 build 12 (Debug/fmo)

    Hardware Rev:      1:7:c:0

    Unit Name:         FSL01E3B1

    Ethernet MAC:      00:04:9F:01:E3:B1

    Ethernet IP:, Subnet Mask:, (Static)

    Target CPU:        Cavium

    Core Access Select: 1

    Connected via:     TCP/IP, Device name: fsl01e3b1.ddns.sje.mentorg.com

    Target Endian:     big

    Reading commands from d:\CodeBench\MIPS_ELF-2012-9-65\i686-mingw32\mips-sde-elf\


    MON> +q  // Enter quiet mode

    Reading cn63xx-evb.maj ...

    ice_jtag_clock_freq = 18.75

    Target is Halted

    CPU 0 selected, core_access_select = 1

    .ebase.cpunum           0

    Error: Could not find file "mep-ejtag-cn63xx.rd"

    Processing register file: d:\CodeBench\MIPS_ELF-2012-9-65\i686-mingw32\mips-sde-


    Executing RTI script function

    Notification from the target:

    Target system reset the processor--reset command may be required

    Initializing target...

    Initializing target using ddr3_lmc0_WD3UE02GX818_1333L_CT_1333MHz.cmd

    Exiting ddr3_lmc0_WD3UE02GX818_1333L_CT_1333MHz.cmd ...

    Initializing target done.

    Finished reading cn63xx-evb.maj.


  5. To start the flash utility running all you now need to do is run issue call the flash command script as shown below:

    MON> flash

    Flash remapped to 0xbc000000 to allow writing the whole 8MB

    loading ../../../bin\mips/be/epiflash.elf

    EPI Flash Programmer v3.1.7.2 - BEsection .excvec  from ffffffff80000000 to ffffffff800002ff
    section .text   from ffffffffa0001000 to ffffffffa0019d47

    section .boot   from ffffffffa0019d48 to ffffffffa001a707

    section .rodata  from ffffffffa001b000 to ffffffffa001f665

    section .eh_fram from ffffffffa001f668 to ffffffffa001f66b

    section .sdeinit from ffffffffa001f66c to ffffffffa001f67f

    section .sdefini from ffffffffa001f680 to ffffffffa001f683

    section .sdeosab from ffffffffa001f684 to ffffffffa001f68b

    section .data   from ffffffffa001f690 to ffffffffa00211ff
    section .ctors  from ffffffffa0021200 to ffffffffa0021207

    section .dtors  from ffffffffa0021208 to ffffffffa002120f

    section .jcr    from ffffffffa0021210 to ffffffffa0021213

    section .sdata  from ffffffffa0021218 to ffffffffa0021275

    section .sbss   from ffffffffa0021278 to ffffffffa002129f

    section .bss    from ffffffffa00212a0 to ffffffffa002246f

    Entry address set (pc): ffffffffa0001100


    ffffffffa0001100:    40086000  mfc0        a4,$12

    Flash Device   : Am29LV640MT  x8  8MEG  Boot Top

    Devices        : 1-Series  1-Parallel  1-Total

    Sector Groups  :    2

    Sector Count   :  127     8

    Sector Size    :   64K   8K

    Device Base    : 0xBF400000

    Device Offset  : 0x00000000

    Device Buffer  :         0 (bytes, max = 32)

    Filename       : y:\archive\SDK-TRUNK\octeon_ebb6300\u-boot.bin

    File Offset    :         0  (0x00000000)

    File Length    :         0  (0x00000000)

    Image Size     :         0  (0x00000000)

    Image Address  : 0xBF400000

    Image Buff Size : 0x00000000 (bytes, Disabled)

    Image Buff Addr : 0x00000000 (Addr)


    1) Flash Type

    2) Image Filename

    3) Device Base Address

    4) Device Offset

    5) Image Size

    6) Erase Menu

    7) Program Menu

    8) Diagnostic Menu

    9) Flash Device Menu

    10) Configuration Menu

    0) QUIT Program

    Select an Option:



You are now ready to select a file in and perform flash operations.  The follow sections provide details various setup options for the flash utility.






Flash Configuration

EPI flash supports a wide varity of of flash NOR flash parts. The file <install dir>/i686<host>/mips_sde/mep//bin/mips/flash_parts.txt contains a list of parts and more importantly a list of equivilent flash part name names.  If a flash part is not currently supported by this utility you should contact Mentor about it and/or requrest a source package for the flash utility.  The source package provides all the files needed to build the flash utility with Codebench.

Flash Setting:

Target Flash displays the following flash configuration settings. These flash configuration settings must be correct for Target Flash to work properly. The following sections explain how to set the flash settings.

After you have set them, you can save them via the Configuration menu so they will be remembered next time you run Target Flash.


Target Flash Programmer v3.1.7.2 - BE



Flash Device   : Am29LV033C  x8  4MEG

Devices        : 1-Series  1-Parallel  1-Total

Sector Groups  :    1

Sector Count   :   64

Sector Size    :   64K

Device Base    : 0xBFC00000

Device Offset  : 0x00000000

Device Buffer  :         0 (bytes, max = 0)




Filename       : test.bin

File Offset    :         0  (0x00000000)

File Length    :         0  (0x00000000)

Image Size     :         0  (0x00000000)

Image Address  : 0xBFC00000

Image Buff Size : 0x00000000 (bytes, Disabled)

Image Buff Addr : 0x00000000 (Addr)



Flash Device

To set the Flash Device, select the Flash Type option from the main menu. First, it will ask for the flash part vendor, then, it will ask for the flash device type. For some flash parts it will also ask for the device width (8 vs. 16 bit) and sector organization (top vs. bottom boot mode). After you set the flash type, Target Flash will display the new flash configuration settings so you can check. The Sector Groups, Sector Count, and Sector Size fields should reflect the details of the part type that you selected.

NOTE:If you do not find your flash device type in the list displayed by Target Flash, then you should check the <install>/targetflash/flash_parts.txtfile to see if a compatible part is cross referenced there.


Multiple Devices

If your board has two flash devices of the same type connected in series or in parallel, Target Flash can operate on them together. You can select two in a series or two in parallel via the Flash Device menu.



  • They are connected in parallel if they occupy different byte lanes on the data bus and can be accessed simultaneously.
  • They are connected in series if they are connected to the same byte lane(s), and the first address of the second part comes immediately after the last address of the first device.


Device Base

The Device Base should be set to the first address of the flash device, no matter whether you want to program all or just part of your flash device. This can be set from the main menu.


Device Offset

The Device Offset should normally be 0, unless your flash image will only occupy upper sectors of the flash part and you do not want to erase or program the lower sectors.


Device Buffer

Many newer flash devices provide a write buffer to faster programming. When you select the flash device Target Flash sets the Device Buffer to the size of the write buffer for that part, or 0 if the part has no write buffer. During flash programming, Target Flash uses buffered write mode if the device buffer is non-zero, or normal write mode if the device buffer is zero. If you experience trouble programming a part, but you are able to erase it, then you may need to change the device buffer size in the Flash Device menu.


Image Settings

After displaying the flash settings, Target Flash displays the image settings.


Filename : test.bin

File Offset : 0 (0x00000000)

File Length : 0 (0x00000000)

Image Size : 0 (0x00000000)

Image Address : 0x10000000

Image Buffer : 0x00800000 (bytes, Enabled)


Image Filename

The Filename is the file to program into the flash part(s). To specify the image filename, including the path to the file, select the Image Filename option in the main menu.


File Offset

The File Offset field allows you to start programming part way through the file, instead of starting with the first byte of the file. For example, you could skip over a header that was prepended to the file. Normally this option should be set to 0.


File Length

The File Length field is automatically set when you choose the image filename, and you can not change it (except by choosing a different file).


Image Size

Normally the Image Size should be set to match the file length, but you can use that setting to constrain the amount of flash being programmed if upper sections need to be preserved, or to operate on the entire flash instead of just the part corresponding to the image file. To set the image size, select the Image Size option in the main menu.


Image Address

The Image Address field shows the range of flash memory that is occupied by the selected image size. The start address is the device base address plus device offset, the end of the range is the start address plus the image size (the end address is not shown if the image size is 0).


Image Buffer

This is an advanced setting that is optional. It allows a copy of the image file to be saved locally when the device is programmed, so the program verify operation can complete faster. If your target has at least twice as much RAM as flash, and you are programming a large flash image, then you might want to enable the image buffer.

To setup an image buffer, select Configuration > Image Buffer to display the following menu.



1) Enable Image Buffer

2) Use malloc For Image Buffer

3) Image Buffer Size

4) Image Buffer Address

5) Test Image Buffer Memory


First, set the Image Buffer Size to the flash device size (or total size, if you have multiple devices). For MIPS targets, set the Image Buffer Address to 1Meg above the start of your RAM area. Then, enable the image buffer and optionally test it.


Target Flash Operation

After you have the flash and image settings all correctly set, it is a good idea to save the settings so they will be remembered next time you run Target Flash. You can save the settings using the Configuration menu.



Use the Erase menu to erase part, or all, of the device, to verify that the area or device is erased, or to search for erased and programmed sections. The Erase Device option erases every sector of your flash part(s). The Erase Image Sector(s) option erases the sectors corresponding to the image address.



Use the Program menu to back up the flash part to a file, to program the image file into flash, or to search for programmed sections. This menu also provides options to erase the whole device or the sectors corresponding to the image address prior to programming the selected file.


Special Modes

Some target boards require special programming modes. For example, it may be necessary to XOR the address with 2 or 3 to ensure the flash command bytes are routed to the data bus byte lanes that are used by the flash device(s). This is a function of the processor's bus interface and endian mode of your memory system.

If your target requires special handling of address bits 1..0, set the XOR option accordingly via the XOR Address option in the Program menu. Please refer to your processor documentation for more information about this potential requirement.

It may also be desirable to byte-swap the image being programmed, backed up (saved from flash to a file), or verified. Byte swapping may be set using the Swap options in the Program menu.


Diagnostic Menu

Use the Diagnostic menu if you need to test the special modes listed above or if you need to check basic flash functionality.



Flash operations such as erase and program are performed by writing a command to the flash part, then polling the flash part for status. Most flash operations take much longer to complete than the single bus cycle that it takes to initiate them, so polling for status is how Target Flash determines when it can advance to the next operation. If there is some problem with the hardware, the flash operation might never be able to complete, so Target Flash employs a timeout mechanism to abort if it appears that an operation will not complete.

However, since Target Flash is a generic program meant to run on any target that has sufficient RAM, it does not have a real time base to use for the timeout. Instead, it uses a large loop counter, which means the actual timeout period is a function of the speed of the processor. On particularly fast processors the timeout may occur too soon even though the flash operation would eventually complete. In this case, you can increase the timeout period for the various flash operations using the Configuration menu.