Thank you for your comments and hints.
(on merging the fis and fconfig) AFAIK, it is default in redboot.
Perhaps it is for certain platforms, but it's certainly not the case for the ap51 (I'm using the reference redboot with your patches and mine). But it's otherwise a good idea keeping the fis and fconfig together. Actually, with a little tweaking it's probably possible to merge all the config blocks into a single one. This would required copying the whole block to ram each time a config were updated, but since it's not done very often, it shouldn't be a problem.
I'm using redboot only for loading kernel from flash or from network, so I have removed FIS, configuration (it is hardcoded) and other debugging stuff from redboot.
The fis is very convenient for prototyping, but it's probably unnecessary for production. How do you get rid of the debugging stuff?
I've got different value: about ~100kb between gzip and lzma compressed kernel.
Of course that figure varies depending on the kernel config options and I'm probably lucky getting 25%.
(on detecting code length) ... It is simple, because of flat memory model !
I tried that, but at least on one occasion I got the wrong numbers because apparently the linker or gcc had relocated the code, changing the order of each procedure. Do you know how to prevent this from happening?
(on detecting whether code runs from ROM) This can be made by address value in epc ($14)
This probably works, but I was looking for a more portable way. Aren't there any global variables in redboot that tell you where the ROM is? Then because of the flat memory model it should be just a matter of comparing the pointer of the current function with those values, right?
Well, now to a completely different issue. I was thinking whether it would be possible to completely replace the original firmware with redboot and openwrt using just the web interface. I think this could be done in stages: first an intermediate image is loaded that will install redboot and a minimal kernel with a web interface. Then this could be used to load a final redboot and openwrt. It would be convenient and would avoid opening the case and so it's less time-consuming. We have over 200 of these ap's in the field and opening each of them is certainly not a good prospect.
Do you think this is possible?