[U-Boot] U-Boot for MIPS AR7161
Was a u-boot created for the wzr-hp-g300nh? And if so was there a way to flash it via jtag? I recently wiped the bootloader on my router, i have access to jtag via bus blaster and openocd, but do not know how to flash. Please help Thank you http://lists.denx.de/pipermail/u-boot/2012-November/140917.html ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
Greetings In general that's the last variant http://dioptimizer.narod.ru/files/ap96/u-boot.bin (160 Kb) It is advisable to flash original bootloader, and only then something is seriously flash on the router. If something does not work, see the file: ap96/boot/u-boot/include/configs/ap96.h (here the main SETUP platform) How to compile the source code: 1. Extract the archive to the rights 2. Go to the folder ./build 3. Run make BOARD_TYPE=ap96 uboot After build, compiled variants of uoot's will be in: ./ap96/boot/u-boot/ (elf, bin, srec, etc. format) and ./images/ap96/ (only bin format) http://www.mediafire.com/?5rljo2y95dypd8z (109 Mb) P.S. Notify, wakes it work flinfo for the second bank of flash memory. ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
Dear Dmytro, Thank you, with this I was able to rewrite the flash! I now have been able to restore the original boot loader, and I still have interest in developing a bootloader that has additional features, however, with this I believe I can recover the device back to its original configuraration. Thank you for the source for this, I will attempt to resolve the remaining issues. When I have resolved them, I would be happy to share the results. Allan From: Dmytro [dioptimi...@gmail.com] Sent: Monday, December 03, 2012 01:28 To: Drassal, Allan Cc: U-Boot Mailing List Subject: Re: [U-Boot] U-Boot for MIPS AR7161 Greetings In general that's the last variant http://dioptimizer.narod.ru/files/ap96/u-boot.bin (160 Kb) It is advisable to flash original bootloader, and only then something is seriously flash on the router. If something does not work, see the file: ap96/boot/u-boot/include/configs/ap96.h (here the main SETUP platform) How to compile the source code: 1. Extract the archive to the rights 2. Go to the folder ./build 3. Run make BOARD_TYPE=ap96 uboot After build, compiled variants of uoot's will be in: ./ap96/boot/u-boot/ (elf, bin, srec, etc. format) and ./images/ap96/ (only bin format) http://www.mediafire.com/?5rljo2y95dypd8z (109 Mb) P.S. Notify, wakes it work flinfo for the second bank of flash memory. ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
Hi Allan, 2012/12/2 Drassal, Allan dra...@wsu.edu Sorry I need to shorten the message, exchange keeps trying to do something and I keep getting a message rejected due to No base64 encoded MIME text parts allowed U-Boot list keeps rejecting the message. U-Boot list driving me nuts... keeps rejecting my message due to the No base64 encoded MIME text parts allowed error, but there are none!! Please see the full message at http://www.eecs.wsu.edu/~adrassal/reply_2012-12-02.txt And if someone can explain this strange error message... please! only send UTF-8 encoded text mails Oh, you are wonderful! This actually loads up correctly! Thanks a lot!!! I am going to paste the output here so you can see. However, it seems to be missing support for flinfo and for cp.b (the command I use to recopy the flash. It detects the FLASH as 8MB, where in reality it is 32MB (or 2 16MB units) do you know that OpenWRT has a minimal U-Boot for AR71xx [1]. Though it supports only some Zyxel board you have at least some basic drivers for UART, Ethernet, SPI on AR71xx. But it has no low-level init support so you can boot it only from RAM. If possible, can these be added in? And, of course, I would like to know how you accomplished this, I would be more intested in learning how to build U-Boot for this platform, and hopefully I can get a fully functional U-Boot built later. I suggest that you try to build at first a RAM boot U-Boot based on mainline U-Boot for your board with [1] as reference source. For a fully working U-Boot you need deeper knowledge about how initialization of clocks, PLL and RAM works on the AR71xx. The easiest way to get that is to have access to either sources from an Atheros BSP U-Boot or a SoC manual. Do you have that? [1] http://git.mirror.nanl.de/?p=openwrt/trunk.git;a=tree;f=package/boot/uboot-ar71xx;h=fdf321392fd39a116da6d277fa03403814492ca5;hb=HEAD -- Best regards, Daniel ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
Dear Drassal, Allan, In message 872e3b9a58411441878dd99be03d7cf510d42...@exmb-02.ad.wsu.edu you wrote: Sorry I need to shorten the message, exchange keeps trying to do something and I keep getting a message rejected due to No base64 encoded MIME text parts allowed U-Boot list keeps rejecting the message. This has nothing to do with message _size_. U-Boot list driving me nuts... keeps rejecting my message due to the No base64 encoded MIME text parts allowed error, but there are none!! Please see the full message at http://www.eecs.wsu.edu/~adrassal/reply_2012-12-02.txt This may be what you intended to send, but it is not what was actually transmitted by your combination of MUA / MTA. And if someone can explain this strange error message... please! The error message is supposed to be self-explaining. We do not allo MIME multi-part messages where one or more parts are base64 encoded MIME text parts. Fix your mailer to send plain text only. No HTML, no base64 encoded text parts. That's all. Best regards, Wolfgang Denk -- DENX Software Engineering GmbH, MD: Wolfgang Denk Detlev Zundel HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: w...@denx.de There is nothing new under the sun, but there are lots of old things we don't know yet. - Ambrose Bierce ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
Sorry I need to shorten the message, exchange keeps trying to do something and I keep getting a message rejected due to No base64 encoded MIME text parts allowed U-Boot list keeps rejecting the message. U-Boot list driving me nuts... keeps rejecting my message due to the No base64 encoded MIME text parts allowed error, but there are none!! Please see the full message at http://www.eecs.wsu.edu/~adrassal/reply_2012-12-02.txt And if someone can explain this strange error message... please! Oh, you are wonderful! This actually loads up correctly! Thanks a lot!!! I am going to paste the output here so you can see. However, it seems to be missing support for flinfo and for cp.b (the command I use to recopy the flash. It detects the FLASH as 8MB, where in reality it is 32MB (or 2 16MB units) If possible, can these be added in? And, of course, I would like to know how you accomplished this, I would be more intested in learning how to build U-Boot for this platform, and hopefully I can get a fully functional U-Boot built later. If it is difficult, at least now I can load something into ram (such as the kernel and original FS!) and execute them from there! The output has been cut from this message and saved to http://www.eecs.wsu.edu/~adrassal/reply_2012-12-02.txt ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
Hello again Here I tried to create the bootloader. http://dioptimizer.narod.ru/files/ap96/u-boot.bin http://dioptimizer.narod.ru/files/ap96/u-boot.md5 For tftp: 192.168.1.1 -router ip 192.168.1.2 -must be your ethernet ip It must be loaded into memory at address: 0xa001 Then in OpenOCD (telnet) put: resume 0xa001 By the way you can check the boot on the work device, it's faster: tftpboot 0xa001 u-boot.bin go 0xa001 2012/12/1, Drassal, Allan dra...@wsu.edu: I think I made a little more progress... Using the following commands I can get output from the UART... # set GPIO 9 10 as UART mww 0xb804 0x400 mww 0xb8040028 0x100 mww 0xb8020004 0x0 mww 0xb802000c 0x83 mww 0xb802 0x51 mww 0xb8020004 0x0 mww 0xb802000c 0x3 mww 0xb8020008 0xc1 mww 0xb802 0x54 mww 0xb802 0x45 mww 0xb802 0x53 mww 0xb802 0x54 mww 0xb802 0x0D mww 0xb802 0x0A After executing the first two commands, then running the loader program I can get UART output, but it is all garbled. It is like I have not selected the correct BAUD, but I have tried all speeds. Possibly there is a mismatch in the internal clock calibration and the way the loader is calculating UART speeds. Is this the PLL configuration that I should be looking at? From: u-boot-boun...@lists.denx.de [u-boot-boun...@lists.denx.de] on behalf of Drassal, Allan [dra...@wsu.edu] Sent: Friday, November 30, 2012 20:14 To: Dmytro Cc: Luka Perkov; U-Boot Mailing List Subject: Re: [U-Boot] U-Boot for MIPS AR7161 Hi Dmytro, Thanks for your detailed response. I corrected some details in the ar71xx.cfg file and am posting them below this message. With this, I am convinced that my JTAG interface is working and the DRAM controller is getting setup correctly. Now, I am just needing some code to load into the processor. I would like to port U-Boot over to this platform, but it is a little above my experience level at the moment. Perhaps it has already been done and I am not looking in the right place. This platform is technically based on AP96 I believe though. I connected up the two devices today and did these checks, these are the results... However, the response from the two devices is slightly different... You can see the results below... I needed to do a reset init before the file would load successfully... I assume the DRAM controller is initialized at this point and not if I just open up openOCD. if I just did a straight halt without a reset init, then the PC is different On the non-functioning device I am assuming it begins to execute code at 0xbfc00380, but runs into something it can't execute and either loops or freezes there. reset JTAG tap: ar71xx.cpu tap/device found: 0x0001 (mfg: 0x000, part: 0x, ver: 0x0) halt target state: halted target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380 results from broken device halt target state: halted target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380 mdw 0xb800 0x10 0xb800: 77bc8cd0 81d106a8 0133 0002 2000 00ff 0081 0xb820: 0081 0081 0081 mdw 0xb805 0xb805: 001040a3 mdw 0xb8050008 0xb8050008: mdw 0xb805000c 0xb805000c: results from working device ar7100 md 0xb800 0x10 b800: 77b8884e 812cd6a8 0033 w..N.,.3 b810: 44a6 00ff 0007..D. b820: 0007 0007 0007 b830: ar7100 md 0xb805 0x1 b805: c0140180 ar7100 md 0xb8050008 0x1 b8050008: ar7100 md 0xb805000c 0x1 b805000c: ar7100 results of loading a file and checking the read memory is the same reset init JTAG tap: ar71xx.cpu tap/device found: 0x0001 (mfg: 0x000, part: 0x, ver: 0x0) target state: halted target halted in MIPS32 mode due to debug-request, pc: 0xbfc0 load_image mtd0.bin 0xa001 327680 bytes written at address 0xa001 downloaded 327680 bytes in 3.917356s (81.688 KiB/s) mdw 0xa001 0x10 0xa001: 10ff 10fd 1dbb 1db9 0xa0010020: 1db7 1db5 1db3 1db1 mdw 0xa001 0x10 0xa001: 10ff 10fd 1dbb 1db9 0xa0010020: 1db7 1db5 1db3 1db1 mdw 0xa001 0x10 0xa001: 10ff 10fd 1dbb 1db9 0xa0010020: 1db7 1db5 1db3 1db1 ar71xx.cfg: # Atheros AR71xx MIPS 24Kc SoC. # tested on PB44 refererence board adapter_nsrst_delay 100 jtag_ntrst_delay 100
Re: [U-Boot] U-Boot for MIPS AR7161
0xb818 0x ;# DDR Read Data This Cycle value (16bit: 0x) mww 0xb814 0x44a6 ;# DDR refresh value mww 0xb818 0x00ff ;# DDR Read Data This Cycle value (16bit: 0x) mww 0xb81c 0x7 ;# delay added to the DQS line (normal = 7) mww 0xb820 7 mww 0xb824 7 mww 0xb828 7 } # setup working area somewhere in RAM $TARGETNAME configure -work-area-phys 0xa060 -work-area-size 0x2 # serial SPI capable flash # flash bank driver base size chip_width bus_width From: Luka Perkov [l...@openwrt.org] Sent: Thursday, November 29, 2012 01:21 To: Dmytro Cc: Drassal, Allan; U-Boot Mailing List Subject: Re: [U-Boot] U-Boot for MIPS AR7161 Hi Dmytro, On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote: But if all you have decided to go to the end, or you need a JTAG fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform), so you can make the example of his version of the loader for AR71xx (AP96 platform). Please show us your patch. Luka ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
(rst: 0x80d106a8) mww 0xb810 8;# force precharge all banks mww 0xb810 1;# force EMRS update cycle mww 0xb80c 0;# clr ext. mode register mww 0xb810 2;# force auto refresh all banks mww 0xb810 8;# force precharge all banks mww 0xb808 0x31 ;# set DDR mode value CAS=3 mww 0xb810 1;# force EMRS update cycle mww 0xb814 0x461b ;# DDR refresh value mww 0xb818 0x ;# DDR Read Data This Cycle value (16bit: 0x) mww 0xb81c 0x7 ;# delay added to the DQS line (normal = 7) mww 0xb820 0 mww 0xb824 0 mww 0xb828 0 } # setup working area somewhere in RAM $TARGETNAME configure -work-area-phys 0xa060 -work-area-size 0x2 # serial SPI capable flash # flash bank driver base size chip_width bus_width From: Dmytro [dioptimi...@gmail.com] Sent: Friday, November 30, 2012 16:11 To: Drassal, Allan Cc: Luka Perkov; U-Boot Mailing List Subject: Re: [U-Boot] U-Boot for MIPS AR7161 Hi Allan Drassal, Frankly, I'm not in practice faced ar71xx processors in labs, but I can give details on experience with the ar724x CPUs. First we need to determine are fully is support in ar71xx.cfg file for your device. You need connect to the JTAG and switch the device in halt mode. Next read the following registers using OpenOCD: mdw 0xb800 0x10 mdw 0xb805 mdw 0xb8050008 mdw 0xb805000c On the second device with a working firmware, do the same thing, only in u-boot (it's as though after the initialization of the CPU): md 0xb800 0x10 md 0xb805 0x1 md 0xb8050008 0x1 md 0xb805000c 0x1 What is it for? Before initializing the processor - PLL records are in resetting state These values are described in the files ar71xx.cfg or ar724x.cfg in parentheses. Then based on these (reset) values are any operation with PLL. I.e. We do not just give to known command to processor - We read from the processor value and produce a binary operation on it according to the rules described in the source lowlevel_init (if you take the PLL). The same thing with the any initialization process. Need will explain how to work with ar71xx.cfg configuration file. Event reset-halt-post thegas telnet command reset halt but this command directly related to the physical nSRST. I.e. During the execution of commands reset halt - nSRTS goes to logic 1 at the same time, this processor receives commands switch to halt. In my experience on ar724x CPUs - is no longer used nSRTS and has been replaced on RST so reset halt does not work in my case and the difficulty I had was that it was necessary to make sure that the processor is switched to the correct mode, and it was settings needed register (make sure you can read the mdw 0xb805 after the event is triggered and you will once again transferred CPU in halt mode.). As a last resort you can do ar71xx.cpu invoke-event reset-halt-post (if not work reset halt as it should) for example in the instructions: http://www.google.com/translate_c?langpair=ru|enu=http://wiki.openwrt.org/ru/toh/tp-link/tl-mr3420/debrick%2525using%2525jtag The next step will be a check memory: You need to load the image in the memory at 0xa001 load_image iamge.bin 0xa001 (Address window of DRAM memory at the platform AP96, PB42, etc. - 0xa001) and most importantly, it immediately check and compare with the original in HEX mode mdw 0xa001 0x10 mdw 0xa001 0x10 (check 2 times) This is due to the fact that If the specified is not correct timings for the memory then the first read memory may even be quite normal, but when we re-reading data, the data may already be offset (and eventually, the data starts, as if to float). Usually corrects this problem by selecting values in the less side DQS0, DQS1 line. Bootloader 8Muboot_RAM_version.bin course is not suitable for your purpose, you need to compile the bootloader for your platform and your address space (0xa001). So far the only thing I can say about it - I'm trying to solve this problem and will soon let you know the results. P.S. As variants, there are plenty of opportunities to find the right boot for your processor, for example there is a recovery function for COMPEX devices: http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/How% 20to% 20JTAG% 20to% 20Compex% 20Loader.pdf (Instruction) http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/upbios.tst (needed file for flash via tftp (without UART)) https://dev.openwrt.org/attachment/ticket/8393/init-ar7130-32m.mac (config for OCD Commande - can easily be changed to OpenOCD) http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/wp543.rar (bootloader for ar7130) http://www.cpx.cz/dls/wpe72_WPE72NX_MMJ5N26E/wp72_loader_jtag.zip (as bonus this for ar724x - not tested with me) Regards, Dmytro 2012/11
Re: [U-Boot] U-Boot for MIPS AR7161
I think I made a little more progress...
Using the following commands I can get output from the UART...
# set GPIO 9 10 as UART
mww 0xb804 0x400
mww 0xb8040028 0x100
mww 0xb8020004 0x0
mww 0xb802000c 0x83
mww 0xb802 0x51
mww 0xb8020004 0x0
mww 0xb802000c 0x3
mww 0xb8020008 0xc1
mww 0xb802 0x54
mww 0xb802 0x45
mww 0xb802 0x53
mww 0xb802 0x54
mww 0xb802 0x0D
mww 0xb802 0x0A
After executing the first two commands, then running the loader program I can
get UART output, but it is all garbled.
It is like I have not selected the correct BAUD, but I have tried all speeds.
Possibly there is a mismatch in the internal clock calibration and the way the
loader is calculating UART speeds.
Is this the PLL configuration that I should be looking at?
From: u-boot-boun...@lists.denx.de [u-boot-boun...@lists.denx.de] on behalf of
Drassal, Allan [dra...@wsu.edu]
Sent: Friday, November 30, 2012 20:14
To: Dmytro
Cc: Luka Perkov; U-Boot Mailing List
Subject: Re: [U-Boot] U-Boot for MIPS AR7161
Hi Dmytro,
Thanks for your detailed response. I corrected some details in the ar71xx.cfg
file and am posting them below this message.
With this, I am convinced that my JTAG interface is working and the DRAM
controller is getting setup correctly.
Now, I am just needing some code to load into the processor.
I would like to port U-Boot over to this platform, but it is a little above my
experience level at the moment.
Perhaps it has already been done and I am not looking in the right place.
This platform is technically based on AP96 I believe though.
I connected up the two devices today and did these checks, these are the
results...
However, the response from the two devices is slightly different...
You can see the results below...
I needed to do a reset init before the file would load successfully...
I assume the DRAM controller is initialized at this point and not if I just
open up openOCD.
if I just did a straight halt without a reset init, then the PC is different
On the non-functioning device I am assuming it begins to execute code at
0xbfc00380, but runs into something it can't execute and either loops or
freezes there.
reset
JTAG tap: ar71xx.cpu tap/device found: 0x0001 (mfg: 0x000, part: 0x,
ver: 0x0)
halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
results from broken device
halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
mdw 0xb800 0x10
0xb800: 77bc8cd0 81d106a8 0133 0002 2000 00ff
0081
0xb820: 0081 0081 0081
mdw 0xb805
0xb805: 001040a3
mdw 0xb8050008
0xb8050008:
mdw 0xb805000c
0xb805000c:
results from working device
ar7100 md 0xb800 0x10
b800: 77b8884e 812cd6a8 0033 w..N.,.3
b810: 44a6 00ff 0007..D.
b820: 0007 0007 0007
b830:
ar7100 md 0xb805 0x1
b805: c0140180
ar7100 md 0xb8050008 0x1
b8050008:
ar7100 md 0xb805000c 0x1
b805000c:
ar7100
results of loading a file and checking the read memory is the same
reset init
JTAG tap: ar71xx.cpu tap/device found: 0x0001 (mfg: 0x000, part: 0x,
ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc0
load_image mtd0.bin 0xa001
327680 bytes written at address 0xa001
downloaded 327680 bytes in 3.917356s (81.688 KiB/s)
mdw 0xa001 0x10
0xa001: 10ff 10fd 1dbb 1db9
0xa0010020: 1db7 1db5 1db3 1db1
mdw 0xa001 0x10
0xa001: 10ff 10fd 1dbb 1db9
0xa0010020: 1db7 1db5 1db3 1db1
mdw 0xa001 0x10
0xa001: 10ff 10fd 1dbb 1db9
0xa0010020: 1db7 1db5 1db3 1db1
ar71xx.cfg:
# Atheros AR71xx MIPS 24Kc SoC.
# tested on PB44 refererence board
adapter_nsrst_delay 100
jtag_ntrst_delay 100
reset_config trst_and_srst
set CHIPNAME ar71xx
jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1
set TARGETNAME $CHIPNAME.cpu
target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
$TARGETNAME configure -event reset-halt-post {
#setup PLL to lowest common denominator 300/300/150 setting
mww 0xb805 0x000f40a3 ;# reset val + CPU:3 DDR:3 AHB:0
mww 0xb805 0x800f40a3 ;# send to PLL
#next command will reset for PLL changes to take effect
mww 0xb8050008 3
Re: [U-Boot] U-Boot for MIPS AR7161
Hi Dmytro, On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote: But if all you have decided to go to the end, or you need a JTAG fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform), so you can make the example of his version of the loader for AR71xx (AP96 platform). Please show us your patch. Luka ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
0x800f00e8 ;# clr pwrdwn bypass mww 0xb8050008 1;# set clock_switch bit sleep 1 ;# wait for lock # Setup DDR config and flash mapping mww 0xb800 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0) mww 0xb804 0x812cd6a8 ;# DDR cfg2 cdl val (rst: 0x80d106a8) #mww 0xb800 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0) #mww 0xb804 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8) mww 0xb810 8;# force precharge all banks mww 0xb810 1;# force EMRS update cycle mww 0xb80c 0;# clr ext. mode register mww 0xb810 2;# force auto refresh all banks mww 0xb810 8;# force precharge all banks #mww 0xb808 0x31 ;# set DDR mode value CAS=3 mww 0xb808 0x33 ;# set DDR mode value CAS=3 mww 0xb810 1;# force EMRS update cycle #mww 0xb814 0x461b ;# DDR refresh value #mww 0xb818 0x ;# DDR Read Data This Cycle value (16bit: 0x) mww 0xb814 0x44a6 ;# DDR refresh value mww 0xb818 0x00ff ;# DDR Read Data This Cycle value (16bit: 0x) mww 0xb81c 0x7 ;# delay added to the DQS line (normal = 7) mww 0xb820 7 mww 0xb824 7 mww 0xb828 7 } # setup working area somewhere in RAM $TARGETNAME configure -work-area-phys 0xa060 -work-area-size 0x2 # serial SPI capable flash # flash bank driver base size chip_width bus_width From: Luka Perkov [l...@openwrt.org] Sent: Thursday, November 29, 2012 01:21 To: Dmytro Cc: Drassal, Allan; U-Boot Mailing List Subject: Re: [U-Boot] U-Boot for MIPS AR7161 Hi Dmytro, On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote: But if all you have decided to go to the end, or you need a JTAG fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform), so you can make the example of his version of the loader for AR71xx (AP96 platform). Please show us your patch. Luka ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
-Original Message- From: Daniel Schwierzeck [mailto:daniel.schwierz...@gmail.com] Sent: Wednesday, November 28, 2012 9:16 AM To: Drassal, Allan Cc: u-boot@lists.denx.de Subject: Re: [U-Boot] U-Boot for MIPS AR7161 Hi Allan, 2012/11/27 Drassal, Allan dra...@wsu.edu: I am attempting to create a U-Boot image for a router, Buffalo WZR-HP-AG300H, details can be found here, http://wiki.openwrt.org/toh/buffalo/wzr-hp-ag300h. I am having trouble compiling and/or finding a pre-compiled version of U-Boot for it. I am attempting to recover a router that has its bootloader erased, I have an identical router that is functioning and have debug access through JTAG to both devices. have you tried to dump the MTD partition of U-Boot on the working device? I have dumped all the partitions from the working device from the linux console onto a USB memory stick. I located one image on the internet 8Muboot_RAM_version.bin, and loaded it into ram and executed it, but I don't receive any serial output, but it does turn on one LED indicator on the board, indicating that the program did execute somewhat. This was built for the AR724x processor though, and might be why it is not functioning fully. Do you know the original text base address of that binary? If you load the binary to the wrong address, function calls or relocation will not work. The original base address is mapped to flash memory, I believe it is 0xbfc03860. This is the first address the processor looks to upon startup I believe. From my understanding, U-Boot itself contains a short bootstrap as well that configures the DRAM controller, and a few other necessary things, copies itself into DRAM, then transfers execution to the copy that resides in DRAM to continue the next step in U-Boot execution. I have tried to copy the part in DRAM from the working device to the non working device, but I might not have something configured correctly. If I knew what I was looking for, it must be contained in the initial few bytes in the U-Boot loader, the DRAM configuration, etc. Technically I think I should be able to execute this directly in DRAM if I know what to copy over. I have attempted to halt the running board in the bootup, copy the ram contents from one board to the other, and resume the processor, but it seems I am missing something. maybe there are cache coherency problems or the memory controller is not initialized correctly I think this might be the case, but it executes one loader correctly (I think) because it turns on the DIAG LED on the device when loaded into DRAM and executed. But, that does not mean it is not getting stuck somewhere after the LED turns on... I guess I need a deeper understanding of what is going on during the boot process... Generally I think the following happens, but I might be missing something, or over simplified something... 1. Processor starts up and looks to a predetermined address for initial instructions 2. The initial U-Boot bootstrap is loaded 3. This initializes some things such as the UART (for debug), DRAM controller, etc 4. U-Boot is copied to DRAM then executed from there 5. The main U-Boot is executed and initializes the remaining devices 6. Control is (usually) then transferred to a Linux kernel which is loaded into DRAM by U-Boot then executed I am going to attempt to get my toolchain working for building U-Boot, maybe I just need to build a clean image, however, I can't find support for the AR7161 in the mainline, so I might have to piece together parts from various sources to get a complete working build. In reality though, I would rather just use the existing working U-Boot on the working device to start up the non-working device to be able to rewrite the bootloader, however, I might need to compile a new U-Boot to get this far. I have done work with ARM based (SheevaPlug, GuruPlug, DreamPlug) devices before, and they were easier to work with than this MIPS based device, for one I could access the flash directly through JTAG (with exception of the DreamPlug). I can provide a copy of the working devices boot loader if this helps to figure out load addresses and such, I am not sure how the file is build, so looking at the instructions might not make much sense to me. I am assuming it is not compressed in any way since the processor has no way to decompress it until after loading it. I am going to paste below the contents of the openocd file that I am using, along with the initial startup of the working board. I can also provide any other details that are helpful. If I can build a working RAM startup image, that would be great, I can then use that to rewrite the onboard flash memory, or if I can directly access the flash memory through the JTAG, but so far, I have not been successful with that either. I believe I have a working toolchain to build U-Boot, but keep running into odd errors when
Re: [U-Boot] U-Boot for MIPS AR7161
commands used in openocd through a telnet connection to 127.0.0.1 : reset halt reset mww 0xb8060008 3 mww 0xb806000c 0x12c halt mww 0xb805 0x00090828 mww 0xb805 0x00050828 mww 0xb805 0x00040828 mww 0xb8050008 2 mww 0xb8050008 3 halt reset init load_image 8Muboot_RAM_version.bin 0x8000 resume 0x8000 First: You somehow use the initialization commands from ar724x CPU for ar71xx CPU. If you do not see the difference, you do not understand what you count. You already have a configuration file ar71xx.cfg = it enough. The fact that a ar71xx nSRST (unlike ar724x, where nSRST replaced by RST). The difference is significant for a soft reset / restart the processor. I also do not see a response from the CPU when you transfer mode processor reset or halt, probably something you have not connected properly. Or launch openocd incorrectly (not set the program configuration file for CPU). Secondly: You'll probably need your own loader platform AP96 modified so that it removed all the prerequisites for restarting the processor at boot uboot. Also in the source of any processor is a function of LOWLEVEL_INIT, it is virtually repeated initialization ar71xx.cfg, so this function must be disabled or removed to the new RAM bootloader version, as if it will stay, we just reboot the processor at boot uboot via jtag. Considering your experience and knowledge, I suggest you just unsolder flash memory and an external programmer to flash it. But if all you have decided to go to the end, or you need a JTAG fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform), so you can make the example of his version of the loader for AR71xx (AP96 platform). ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] U-Boot for MIPS AR7161
Hi Allan,
2012/11/27 Drassal, Allan dra...@wsu.edu:
I am attempting to create a U-Boot image for a router, Buffalo WZR-HP-AG300H,
details can be found here, http://wiki.openwrt.org/toh/buffalo/wzr-hp-ag300h.
I am having trouble compiling and/or finding a pre-compiled version of U-Boot
for it.
I am attempting to recover a router that has its bootloader erased, I have an
identical router that is functioning and have debug access through JTAG to
both devices.
have you tried to dump the MTD partition of U-Boot on the working device?
I located one image on the internet 8Muboot_RAM_version.bin, and loaded it
into ram and executed it, but I don't receive any serial output, but it does
turn on one LED indicator on the board, indicating that the program did
execute somewhat. This was built for the AR724x processor though, and might
be why it is not functioning fully.
Do you know the original text base address of that binary? If you load
the binary to the wrong address, function calls or relocation will not
work.
I have attempted to halt the running board in the bootup, copy the ram
contents from one board to the other, and resume the processor, but it seems
I am missing something.
maybe there are cache coherency problems or the memory controller is
not initialized correctly
I am going to paste below the contents of the openocd file that I am using,
along with the initial startup of the working board. I can also provide any
other details that are helpful.
If I can build a working RAM startup image, that would be great, I can then
use that to rewrite the onboard flash memory, or if I can directly access the
flash memory through the JTAG, but so far, I have not been successful with
that either.
I believe I have a working toolchain to build U-Boot, but keep running into
odd errors when building possibly due to different toolchain versions.
Any help or assistance would be greatly appreciated.
Thanks,
Allan Drassal
ar71xx.cfg
# Atheros AR71xx MIPS 24Kc SoC.
# tested on PB44 refererence board
adapter_nsrst_delay 100
jtag_ntrst_delay 100
reset_config trst_and_srst
set CHIPNAME ar71xx
jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1
set TARGETNAME $CHIPNAME.cpu
target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
$TARGETNAME configure -event reset-halt-post {
#setup PLL to lowest common denominator 300/300/150 setting
#mww 0xb805 0x000f40a3 ;# reset val + CPU:3 DDR:3 AHB:0
#mww 0xb805 0x800f40a3 ;# send to PLL
mww 0xb805 0x40140180 ;# reset val + CPU:3 DDR:3 AHB:0
mww 0xb805 0xc0140180 ;# send to PLL
#next command will reset for PLL changes to take effect
mww 0xb8050008 3;# set reset_switch and clock_switch
(resets SoC)
}
$TARGETNAME configure -event reset-init {
#complete pll initialization
mww 0xb805 0x800f0080 ;# set sw_update bit
mww 0xb8050008 0;# clear reset_switch bit
mww 0xb805 0x800f00e8 ;# clr pwrdwn bypass
mww 0xb8050008 1;# set clock_switch bit
sleep 1 ;# wait for lock
# Setup DDR config and flash mapping
mww 0xb800 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0)
mww 0xb804 0x812cd6a8 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
#mww 0xb800 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
#mww 0xb804 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
mww 0xb810 8;# force precharge all banks
mww 0xb810 1;# force EMRS update cycle
mww 0xb80c 0;# clr ext. mode register
mww 0xb810 2;# force auto refresh all banks
mww 0xb810 8;# force precharge all banks
#mww 0xb808 0x31 ;# set DDR mode value CAS=3
mww 0xb808 0x33 ;# set DDR mode value CAS=3
mww 0xb810 1;# force EMRS update cycle
#mww 0xb814 0x461b ;# DDR refresh value
#mww 0xb818 0x ;# DDR Read Data This Cycle value
(16bit: 0x)
mww 0xb814 0x44a6 ;# DDR refresh value
mww 0xb818 0x00ff ;# DDR Read Data This Cycle value
(16bit: 0x)
mww 0xb81c 0x7 ;# delay added to the DQS line
(normal = 7)
mww 0xb820 7
mww 0xb824 7
mww 0xb828 7
}
are there no registers for enabling/disabling the memory controller?
Usually you need to disable
a memory controller when changing its configuration and to enable it
to start the
initialization sequence for the DRAM device.
# setup working area somewhere in RAM
$TARGETNAME configure
[U-Boot] U-Boot for MIPS AR7161
I am attempting to create a U-Boot image for a router, Buffalo WZR-HP-AG300H,
details can be found here, http://wiki.openwrt.org/toh/buffalo/wzr-hp-ag300h.
I am having trouble compiling and/or finding a pre-compiled version of U-Boot
for it.
I am attempting to recover a router that has its bootloader erased, I have an
identical router that is functioning and have debug access through JTAG to both
devices.
I located one image on the internet 8Muboot_RAM_version.bin, and loaded it into
ram and executed it, but I don't receive any serial output, but it does turn on
one LED indicator on the board, indicating that the program did execute
somewhat. This was built for the AR724x processor though, and might be why it
is not functioning fully.
I have attempted to halt the running board in the bootup, copy the ram contents
from one board to the other, and resume the processor, but it seems I am
missing something.
I am going to paste below the contents of the openocd file that I am using,
along with the initial startup of the working board. I can also provide any
other details that are helpful.
If I can build a working RAM startup image, that would be great, I can then use
that to rewrite the onboard flash memory, or if I can directly access the flash
memory through the JTAG, but so far, I have not been successful with that
either.
I believe I have a working toolchain to build U-Boot, but keep running into odd
errors when building possibly due to different toolchain versions.
Any help or assistance would be greatly appreciated.
Thanks,
Allan Drassal
ar71xx.cfg
# Atheros AR71xx MIPS 24Kc SoC.
# tested on PB44 refererence board
adapter_nsrst_delay 100
jtag_ntrst_delay 100
reset_config trst_and_srst
set CHIPNAME ar71xx
jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1
set TARGETNAME $CHIPNAME.cpu
target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
$TARGETNAME configure -event reset-halt-post {
#setup PLL to lowest common denominator 300/300/150 setting
#mww 0xb805 0x000f40a3 ;# reset val + CPU:3 DDR:3 AHB:0
#mww 0xb805 0x800f40a3 ;# send to PLL
mww 0xb805 0x40140180 ;# reset val + CPU:3 DDR:3 AHB:0
mww 0xb805 0xc0140180 ;# send to PLL
#next command will reset for PLL changes to take effect
mww 0xb8050008 3;# set reset_switch and clock_switch
(resets SoC)
}
$TARGETNAME configure -event reset-init {
#complete pll initialization
mww 0xb805 0x800f0080 ;# set sw_update bit
mww 0xb8050008 0;# clear reset_switch bit
mww 0xb805 0x800f00e8 ;# clr pwrdwn bypass
mww 0xb8050008 1;# set clock_switch bit
sleep 1 ;# wait for lock
# Setup DDR config and flash mapping
mww 0xb800 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0)
mww 0xb804 0x812cd6a8 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
#mww 0xb800 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
#mww 0xb804 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
mww 0xb810 8;# force precharge all banks
mww 0xb810 1;# force EMRS update cycle
mww 0xb80c 0;# clr ext. mode register
mww 0xb810 2;# force auto refresh all banks
mww 0xb810 8;# force precharge all banks
#mww 0xb808 0x31 ;# set DDR mode value CAS=3
mww 0xb808 0x33 ;# set DDR mode value CAS=3
mww 0xb810 1;# force EMRS update cycle
#mww 0xb814 0x461b ;# DDR refresh value
#mww 0xb818 0x ;# DDR Read Data This Cycle value
(16bit: 0x)
mww 0xb814 0x44a6 ;# DDR refresh value
mww 0xb818 0x00ff ;# DDR Read Data This Cycle value
(16bit: 0x)
mww 0xb81c 0x7 ;# delay added to the DQS line (normal
= 7)
mww 0xb820 7
mww 0xb824 7
mww 0xb828 7
}
# setup working area somewhere in RAM
$TARGETNAME configure -work-area-phys 0xa060 -work-area-size 0x2
# serial SPI capable flash
# flash bank driver base size chip_width bus_width
commands used in openocd through a telnet connection to 127.0.0.1 :
reset
halt
reset
mww 0xb8060008 3
mww 0xb806000c 0x12c
halt
mww 0xb805 0x00090828
mww 0xb805 0x00050828
mww 0xb805 0x00040828
mww 0xb8050008 2
mww 0xb8050008 3
halt
reset init
load_image 8Muboot_RAM_version.bin 0x8000
resume 0x8000
startup sequence of working board:
BUFFALO U-BOOT Ver 1.01
== CPU:680MHz, DDR:340MHz, AHB:170MHz ==
AP96 (ar7100) U-boot 0.0.1
DRAM: 128 MB
Top of RAM usable for U-Boot at: 8400
Reserving 266k for U-Boot at:
