I took a closer look, and it seems that dma mode is triggered correctly. In the
logs I found the following
Debug: 265 369 mips_ejtag.c:299 mips_ejtag_init(): impcode: 0x00800904
Debug: 266 369 mips_ejtag.c:306 mips_ejtag_init(): EJTAG: Version 1 or 2.0
Detected
Debug: 267 370 mips_ejtag.c:328 mips_ejtag_init(): EJTAG: features: R4k DMA
MIPS32
Debug: 268 370 mips_ejtag.c:331 mips_ejtag_init(): EJTAG: DMA Access Mode
Support Enabled
Which detects the impcode as expected. I can halt my target succesfully, too
Debug: 9844 161472 mips32_pracc.c:140 wait_for_pracc_rw(): DEBUGMODULE: No
memory access in progress!
Debug: 9845 161472 mips_m4k.c:112 mips_m4k_debug_entry(): entered debug state
at PC 0x0, target->state: halted
Debug: 9846 161472 target.c:1290 target_call_event_callbacks(): target event 2
(gdb-halt)
Debug: 9847 161472 target.c:1290 target_call_event_callbacks(): target event 3
(halted)
User : 9848 161472 target.c:1663 target_arch_state(): target state: halted
User : 9849 161473 mips32.c:241 mips32_arch_state(): target halted in MIPS32
mode due to debug-request, pc: 0x00000000
But when probing for the flash memory, I get the following output (filtered
the output a bit)
Debug: 9935 163572 command.c:145 script_debug(): command - ocd_command
ocd_command type ocd_flash probe 0
Debug: 9936 163572 command.c:145 script_debug(): command - ocd_flash ocd_flash
probe 0
Debug: 9943 163578 mips_m4k.c:844 mips_m4k_write_memory(): address: 0x9fc00aaa,
size: 0x00000002, count: 0x00000001
Debug: 9972 163658 mips_m4k.c:844 mips_m4k_write_memory(): address: 0x9fc00554,
size: 0x00000002, count: 0x00000001
Debug: 10001 163738 mips_m4k.c:844 mips_m4k_write_memory(): address:
0x9fc00aaa, size: 0x00000002, count: 0x00000001
Debug: 10030 163818 mips_m4k.c:785 mips_m4k_read_memory(): address: 0x9fc00000,
size: 0x00000002, count: 0x00000001
Debug: 10060 163898 mips_m4k.c:785 mips_m4k_read_memory(): address: 0x9fc00002,
size: 0x00000002, count: 0x00000001
Info : 10090 163978 cfi.c:2619 cfi_probe(): Flash Manufacturer/Device: 0xffff
0xffff
Debug: 10091 163978 mips_m4k.c:844 mips_m4k_write_memory(): address:
0x9fc00000, size: 0x00000002, count: 0x00000001
Debug: 10121 164058 mips_m4k.c:844 mips_m4k_write_memory(): address:
0x9fc00000, size: 0x00000002, count: 0x00000001
Debug: 10150 164138 mips_m4k.c:844 mips_m4k_write_memory(): address:
0x9fc000aa, size: 0x00000002, count: 0x00000001
Debug: 10179 164218 mips_m4k.c:785 mips_m4k_read_memory(): address: 0x9fc00020,
size: 0x00000002, count: 0x00000001
Debug: 10209 164298 mips_m4k.c:785 mips_m4k_read_memory(): address: 0x9fc00022,
size: 0x00000002, count: 0x00000001
Debug: 10239 164378 mips_m4k.c:785 mips_m4k_read_memory(): address: 0x9fc00024,
size: 0x00000002, count: 0x00000001
Debug: 10269 164458 cfi.c:2531 cfi_query_string(): CFI qry returned: 0xff 0xff
0xff
Debug: 10270 164458 mips_m4k.c:844 mips_m4k_write_memory(): address:
0x9fc00000, size: 0x00000002, count: 0x00000001
Debug: 10299 164538 mips_m4k.c:844 mips_m4k_write_memory(): address:
0x9fc00000, size: 0x00000002, count: 0x00000001
Error: 10329 164618 cfi.c:2537 cfi_query_string(): Could not probe bank: no QRY
User : 10330 164618 cfi.c:2648 cfi_probe(): Try workaround w/0x555 instead of
0x55 to get QRY.
Debug: 10331 164618 mips_m4k.c:844 mips_m4k_write_memory(): address:
0x9fc00aaa, size: 0x00000002, count: 0x00000001
Debug: 10360 164698 mips_m4k.c:785 mips_m4k_read_memory(): address: 0x9fc00020,
size: 0x00000002, count: 0x0000000
It seems that I get 0xff for every value I read out on the flash starting
address (0x9fc00000). This was the same when I tried to dump a firmware image
using dump_image, except for three occasional b's in the file.
Is this declaration correct for MIPS32 with 16bit sdram interface?
flash bank cfi 0x9fc00000 0x200000 2 2
The CPU uses 32bit instructions and the sdram is 16 bit wide according to the
specs. The flash chip uses Up to One Hundred-Twenty-Seven 32
Kword Blocks, so I suppose the chip width and bus width are correct here?
Also, how should I format the reset-init initialisation instructions? Use mww
or mwh and 16 or 32bit addresses? I found the following in another config file
for this board. Any idea how to convert this to correct openocd syntax for this
board?
// watch dog
Init=0xfffe0224,0
// initialize chip set
Init=0xfffe2300,0x1a
Init=0xfffe2304,0
Init=0xfffe2308,0x8040
Init=0xfffe230C,3
Init=0xfffe2310,0x4824
Thanks
> Date: Thu, 22 Mar 2012 20:58:09 +0000
> Subject: Re: [OpenOCD-devel] MIPS ejtag DMA support
> From: s...@spen-soft.co.uk
> To: jeroen_peelae...@hotmail.com
> CC: openocd-devel@lists.sourceforge.net
>
> On 21 March 2012 10:25, Jeroen Peelaerts <jeroen_peelae...@hotmail.com> wrote:
> >
> > Dears,
> >
> > I have been working on OpenOCD support for the bcm3349 chipset, found in
> > the motorola sb5101 cable modem. I want to be able to use it to flash
> > different firmware to the device. I have succesfully managed to detect the
> > bcm3349 chipset type using a bus pirate as programmer, but up til now the
> > flash memory is not detected correctly.
> >
> > > scan_chain
> > TapName Enabled IdCode Expected IrLen IrCap IrMask
> > -- ------------------- -------- ---------- ---------- ----- ----- ------
> > 0 bcm3349.cpu Y 0x0334917f 0x0334917f 5 0x01 0x03
> >
> > The flash chip is an Intel TE28F160 that, according to the datasheet (
> > http://pdf.chinaicmart.com/88889/44107.pdf ), supports CFI. I found the
> > flash start address in the config file of Tom's Jtag Utility, which is
> > commonly used to flash this modem. The size of the chip is 8MB (check
> > http://www.mail-archive.com/openocd-development@lists.berlios.de/msg04173/jtagkey.cfg
> > config file where this chip is used), which I declared it as follows
> >
> >
> > flash bank cfi 0x9fc00000 0x200000 2 2 0
> >
> >
> > When executing flash probe 0, I get the following error (read abort).
> >
> > Flash Manufacturer/Device: 0x00ff 0x00ff
> > Could not probe bank: no QRY
> > Try workaround w/0x555 instead of 0x55 to get QRY.
> > Could not probe bank: no QRY
> > auto_probe failed
> > in procedure 'flash'
> >
> >
> > When analyszing the logs, I found that openOCD is using the prAcc access
> > method to read and write. Other flash utilities read and write to the flash
> > memory with DMA, for which support was implemented in openOCD a while ago.
> > DMA should be triggered according to the present IMPCODE of the board,
> > which is 00800904 in this case (which means ejtag 1 or 2 according to the
> > code). For some reason, it seems that the impcode is not detected
> > correctly, which makes the code fall back to the prAcc access method.
> >
> > Also, I can't find any clue in the debug messages on the IMPCODE detection.
> >
>
> The detection is there in mips_ejtag_init, so you should see the
> impcode displayed in a debug log.
>
> > * Does anybody have an idea how I can trigger DMA access to the flash
> > memory? Is there a configuration option I can add in the attached cfg to
> > enable it? Currently I am using mips_m4k as a target. I searched the
> > documentation extensively but coiuldn't find anything else relevant.
> > * How can I trigger the reset-init procedure by default when calling
> > using the attached cfg file?
> >
>
> This will happen automatically when 'reset init' is called.
>
> All i can suggest is the usual methods, enable debug log and send to
> to the list.
>
> Cheers
> Spen
------------------------------------------------------------------------------
This SF email is sponsosred by:
Try Windows Azure free for 90 days Click Here
http://p.sf.net/sfu/sfd2d-msazure
_______________________________________________
OpenOCD-devel mailing list
OpenOCD-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openocd-devel
