view · edit · print · history

Linksys NSLU2 Boot Sequence

This page contains a detailed explanation of the boot sequence of the Linksys NSLU2.


The Linksys NSLU2 is based on the Intel IXP420 Network Processor. It contains 32MB of RAM, and 8MB of Flash. The RAM is mapped from 0x00000000 to 0x02000000 (32MB). The Flash is mapped from 0x50000000 to 0x50800000 (8MB), and immediately after reset it is also mapped from 0x00000000 to 0x0FFFFFFF (in repeated 8MB chunks), overriding the first 256MB of the RAM area (from 0x00000000 to 0x10000000) until bit 31 of Configuration Register #0 in the IXP420 is cleared by the boot code.


It is believed that the firmware for the Linksys NSLU2 originates from SerComm Corporation ...

The NSLU2 uses the RedBoot boot loader ...

The Flash memory is partitioned into 4 "/dev/mtdblock" devices:

Linux deviceTypeStart mem addrLengthDescription
/dev/mtdblock0RedBoot0x500000000x40000 (256K)This block contains the code from which the IXP420 boots.
/dev/mtdblock1System Configuration0x500400000x20000 (128K)The NSLU2 configuration e.g. IP address is stored here
/dev/mtdblock2Kernel0x500600000x100000 (1MB)The Linux kernel
/dev/mtdblock3Ramdisk0x501600000x6A0000 (6.625MB)The ramdisk image for /

The customized version of RedBoot on the NSLU2 contains the following additional commands:

  • assign
  • boot
  • move
  • upgrade

Boot Sequence

1. Power is applied, and the IXP420 performs a power-on reset (starting execution at address 0x00000000). At reset, the IXP420's expansion bus memory area is mapped to the lowest 256MB of the address space (in addition to its permanent mapping at 0x50000000 to 0x5FFFFFFF). Therefore, the Redboot firmware image at the start of the flash memory (which is normally mapped at 0x50000000, but which appears at 0x00000000 immediately after reset) is the first code to be executed after reset.

2. The IXP420 starts execution of the "Redboot" firmware image in /dev/mtdblock0. Execution begins with the cyg_start() routine (which can be found in main.c from the Redboot distribution):

* The serial port console is initialised (default setting is 115200,8,N,1).
* The Redboot version, platform, copyright, and memory segment strings are printed to the console by do_version():
 RedBoot(tm) bootstrap and debug environment [ROMRAM]
 Red Hat certified release, version 1.92 - built 15:16:07, Feb 3 2004
 Platform: IXDP425? Development Platform (XScale?)
 Copyright (C) 2000, 2001, 2002, Red Hat, Inc.
 RAM: 0x00000000-0x02000000, 0x000723a0-0x01ff3000 available
 FLASH: 0x50000000 - 0x50800000, 64 blocks of 0x00020000 bytes each.
* The RAM area of 0x00000000 to 0x02000000 corresponds to 32MB.
* The FLASH area of 0x50000000 to 0x50800000 corresponds to 8MB.
* After a two second timeout delay, the built-in boot script is executed:
 == Executing boot script in 2.000 seconds - enter ^C to abort
* During this timeout period, you can hit Control-C on the console to abort the boot script.
* The NSLU2 contains the following built-in boot script:
 boot;exec 0x01d00000
* The boot command loads the Linux kernel and initial ramdisk into RAM.
* The exec command executes the Linux kernel.

3. The Linux kernel begins execution with the command arguments:

 console=ttyS0,115200 root=/dev/ram0 initrd=0x01000000,10M mem=32M@0x00000000

4. Because there is no /linuxrc file in the initial ramdisk, the kernel executes /bin/init, which subsequently executes /etc/rc:

 /usr/bin/Set_Led r_blinking &
 mount -t proc proc /proc
 mount -o remount,rw /dev/root /
 ifconfig lo
 route add -net netmask lo
 /bin/echo "Insmod ixp400"
 insmod ixp400.o
 /bin/echo "Insmod ixp425"
 insmod ixp425_eth.o
 /etc/rc.d/rc.sysinit &

External Links

RedBoot miniHowTo

[Original Source: http://www.rwhitby.net/nslu2/boot-sequence.html]

view · edit · print · history · Last edited by tms13.
Based on work by rwhitby, tman, ka6sox, and Pete Verdon.
Originally by ka6sox.
Page last modified on July 27, 2009, at 12:03 PM