On 21 March 2012 10:25, Jeroen Peelaerts <jeroen_peelae...@hotmail.com> wrote: > > Dears, > > I have been working on OpenOCD support for the bcm3349 chipset, found in the > motorola sb5101 cable modem. I want to be able to use it to flash different > firmware to the device. I have succesfully managed to detect the bcm3349 > chipset type using a bus pirate as programmer, but up til now the flash > memory is not detected correctly. > > > scan_chain > TapName Enabled IdCode Expected IrLen IrCap IrMask > -- ------------------- -------- ---------- ---------- ----- ----- ------ > 0 bcm3349.cpu Y 0x0334917f 0x0334917f 5 0x01 0x03 > > The flash chip is an Intel TE28F160 that, according to the datasheet ( > http://pdf.chinaicmart.com/88889/44107.pdf ), supports CFI. I found the flash > start address in the config file of Tom's Jtag Utility, which is commonly > used to flash this modem. The size of the chip is 8MB (check > http://www.mail-archive.com/openocd-development@lists.berlios.de/msg04173/jtagkey.cfg > config file where this chip is used), which I declared it as follows > > > flash bank cfi 0x9fc00000 0x200000 2 2 0 > > > When executing flash probe 0, I get the following error (read abort). > > Flash Manufacturer/Device: 0x00ff 0x00ff > Could not probe bank: no QRY > Try workaround w/0x555 instead of 0x55 to get QRY. > Could not probe bank: no QRY > auto_probe failed > in procedure 'flash' > > > When analyszing the logs, I found that openOCD is using the prAcc access > method to read and write. Other flash utilities read and write to the flash > memory with DMA, for which support was implemented in openOCD a while ago. > DMA should be triggered according to the present IMPCODE of the board, which > is 00800904 in this case (which means ejtag 1 or 2 according to the code). > For some reason, it seems that the impcode is not detected correctly, which > makes the code fall back to the prAcc access method. > > Also, I can't find any clue in the debug messages on the IMPCODE detection. >
The detection is there in mips_ejtag_init, so you should see the impcode displayed in a debug log. > * Does anybody have an idea how I can trigger DMA access to the flash > memory? Is there a configuration option I can add in the attached cfg to > enable it? Currently I am using mips_m4k as a target. I searched the > documentation extensively but coiuldn't find anything else relevant. > * How can I trigger the reset-init procedure by default when calling using > the attached cfg file? > This will happen automatically when 'reset init' is called. All i can suggest is the usual methods, enable debug log and send to to the list. Cheers Spen ------------------------------------------------------------------------------ This SF email is sponsosred by: Try Windows Azure free for 90 days Click Here http://p.sf.net/sfu/sfd2d-msazure _______________________________________________ OpenOCD-devel mailing list OpenOCD-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openocd-devel
