* [U-Boot] U-Boot for MIPS AR7161
@ 2012-11-27 1:27 Drassal, Allan
2012-11-28 0:16 ` Daniel Schwierzeck
0 siblings, 1 reply; 16+ messages in thread
From: Drassal, Allan @ 2012-11-27 1:27 UTC (permalink / raw)
To: u-boot
I am attempting to create a U-Boot image for a router, Buffalo WZR-HP-AG300H, details can be found here, http://wiki.openwrt.org/toh/buffalo/wzr-hp-ag300h.
I am having trouble compiling and/or finding a pre-compiled version of U-Boot for it.
I am attempting to recover a router that has its bootloader erased, I have an identical router that is functioning and have debug access through JTAG to both devices.
I located one image on the internet 8Muboot_RAM_version.bin, and loaded it into ram and executed it, but I don't receive any serial output, but it does turn on one LED indicator on the board, indicating that the program did execute somewhat. This was built for the AR724x processor though, and might be why it is not functioning fully.
I have attempted to halt the running board in the bootup, copy the ram contents from one board to the other, and resume the processor, but it seems I am missing something.
I am going to paste below the contents of the openocd file that I am using, along with the initial startup of the working board. I can also provide any other details that are helpful.
If I can build a working RAM startup image, that would be great, I can then use that to rewrite the onboard flash memory, or if I can directly access the flash memory through the JTAG, but so far, I have not been successful with that either.
I believe I have a working toolchain to build U-Boot, but keep running into odd errors when building possibly due to different toolchain versions.
Any help or assistance would be greatly appreciated.
Thanks,
Allan Drassal
ar71xx.cfg
# Atheros AR71xx MIPS 24Kc SoC.
# tested on PB44 refererence board
adapter_nsrst_delay 100
jtag_ntrst_delay 100
reset_config trst_and_srst
set CHIPNAME ar71xx
jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1
set TARGETNAME $CHIPNAME.cpu
target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
$TARGETNAME configure -event reset-halt-post {
#setup PLL to lowest common denominator 300/300/150 setting
#mww 0xb8050000 0x000f40a3 ;# reset val + CPU:3 DDR:3 AHB:0
#mww 0xb8050000 0x800f40a3 ;# send to PLL
mww 0xb8050000 0x40140180 ;# reset val + CPU:3 DDR:3 AHB:0
mww 0xb8050000 0xc0140180 ;# send to PLL
#next command will reset for PLL changes to take effect
mww 0xb8050008 3 ;# set reset_switch and clock_switch (resets SoC)
}
$TARGETNAME configure -event reset-init {
#complete pll initialization
mww 0xb8050000 0x800f0080 ;# set sw_update bit
mww 0xb8050008 0 ;# clear reset_switch bit
mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
mww 0xb8050008 1 ;# set clock_switch bit
sleep 1 ;# wait for lock
# Setup DDR config and flash mapping
mww 0xb8000000 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0)
mww 0xb8000004 0x812cd6a8 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
#mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
#mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
mww 0xb8000010 8 ;# force precharge all banks
mww 0xb8000010 1 ;# force EMRS update cycle
mww 0xb800000c 0 ;# clr ext. mode register
mww 0xb8000010 2 ;# force auto refresh all banks
mww 0xb8000010 8 ;# force precharge all banks
#mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
mww 0xb8000008 0x33 ;# set DDR mode value CAS=3
mww 0xb8000010 1 ;# force EMRS update cycle
#mww 0xb8000014 0x461b ;# DDR refresh value
#mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value (16bit: 0xffff)
mww 0xb8000014 0x44a6 ;# DDR refresh value
mww 0xb8000018 0x00ff ;# DDR Read Data This Cycle value (16bit: 0xffff)
mww 0xb800001c 0x7 ;# delay added to the DQS line (normal = 7)
mww 0xb8000020 7
mww 0xb8000024 7
mww 0xb8000028 7
}
# setup working area somewhere in RAM
$TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
# serial SPI capable flash
# flash bank <driver> <base> <size> <chip_width> <bus_width>
commands used in openocd through a telnet connection to 127.0.0.1 4444:
reset
halt
reset
mww 0xb8060008 3
mww 0xb806000c 0x12c
halt
mww 0xb8050000 0x00090828
mww 0xb8050000 0x00050828
mww 0xb8050000 0x00040828
mww 0xb8050008 2
mww 0xb8050008 3
halt
reset init
load_image 8Muboot_RAM_version.bin 0x80000000
resume 0x80000000
startup sequence of working board:
BUFFALO U-BOOT Ver 1.01
== CPU:680MHz, DDR:340MHz, AHB:170MHz ==
AP96 (ar7100) U-boot 0.0.1
DRAM: 128 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 266k for U-Boot at: 83fbc000
Reserving 192k for malloc() at: 83f8c000
Reserving 44 Bytes for Board Info at: 83f8bfd4
Reserving 36 Bytes for Global Data at: 83f8bfb0
Reserving 128k for boot params() at: 83f6bfb0
Stack Pointer at: 83f6bf98
Now running in RAM - U-Boot at: 83fbc000
flash bank #0 found 16 MB flash [W25Q128BV, blk:0x10000, sectors:256]
flash bank #1 found 16 MB flash [W25Q128BV, blk:0x10000, sectors:256]
Flash: 32 MB
In: serial
Out: serial
Err: serial
Memory Test
uboot use 83F6BFB0 - 84000000
Memory Test start(80000000) end(83F00000) size(03F00000)
Pattern 00000000 Writing... Reading...
Memory Test start(84000000) end(88000000) size(04000000)
Pattern 00000000 Writing... Reading...
Memory Test OK
### buf_ver=[1.01] U-Boot Ver.=[1.01]
### build_date(env)=[Jan 14 2011 - 05:47:09] build_date(bin)=[Jan 14 2011 - 05:]
ag7100_enet_initialize...
Reading MAC Address from ENV(0x83f8c2fd)
Port 0, Neg Success
Port 1, Neg Success
Port 2, Neg Success
Port 3, Neg Success
eth0: Phy Specific Status=0010
eth0: Phy Specific Status=0010
eth0: Phy Specific Status=0010
eth0: Phy Specific Status=0010{leth0: 02:aa:bb:cc:dd:20
eth0 up
Reading MAC Address from ENV(0x83f8c2fd)
Port 4, Neg Success
eth1: Phy Specific Status=0010
eth1: 02:aa:bb:cc:dd:21
eth1 up
eth0 02:AA:BB:CC:DD:20
, eth1 02:AA:BB:CC:DD:21
eth0 link down
tftp server(receive) go, waiting:4[sec]
eth0 link down
Load address: 0x84000000
Abort
no file was loaded.
ar7100>
ar7100> flinfo
Bank # 1:
flash-id : EF401800
Size: 16384 KB in 256 Sectors
Sector Start Addresses:
BF000000 RO BF010000 RO BF020000 RO BF030000 RO BF040000
BF050000 RO BF060000 BF070000 BF080000 BF090000
BF0A0000 BF0B0000 BF0C0000 BF0D0000 BF0E0000
BF0F0000 BF100000 BF110000 BF120000 BF130000
BF140000 BF150000 BF160000 BF170000 BF180000
BF190000 BF1A0000 BF1B0000 BF1C0000 BF1D0000
BF1E0000 BF1F0000 BF200000 BF210000 BF220000
BF230000 BF240000 BF250000 BF260000 BF270000
BF280000 BF290000 BF2A0000 BF2B0000 BF2C0000
BF2D0000 BF2E0000 BF2F0000 BF300000 BF310000
BF320000 BF330000 BF340000 BF350000 BF360000
BF370000 BF380000 BF390000 BF3A0000 BF3B0000
BF3C0000 BF3D0000 BF3E0000 BF3F0000 BF400000
BF410000 BF420000 BF430000 BF440000 BF450000
BF460000 BF470000 BF480000 BF490000 BF4A0000
BF4B0000 BF4C0000 BF4D0000 BF4E0000 BF4F0000
BF500000 BF510000 BF520000 BF530000 BF540000
BF550000 BF560000 BF570000 BF580000 BF590000
BF5A0000 BF5B0000 BF5C0000 BF5D0000 BF5E0000
BF5F0000 BF600000 BF610000 BF620000 BF630000
BF640000 BF650000 BF660000 BF670000 BF680000
BF690000 BF6A0000 BF6B0000 BF6C0000 BF6D0000
BF6E0000 BF6F0000 BF700000 BF710000 BF720000
BF730000 BF740000 BF750000 BF760000 BF770000
BF780000 BF790000 BF7A0000 BF7B0000 BF7C0000
BF7D0000 BF7E0000 BF7F0000 BF800000 BF810000
BF820000 BF830000 BF840000 BF850000 BF860000
BF870000 BF880000 BF890000 BF8A0000 BF8B0000
BF8C0000 BF8D0000 BF8E0000 BF8F0000 BF900000
BF910000 BF920000 BF930000 BF940000 BF950000
BF960000 BF970000 BF980000 BF990000 BF9A0000
BF9B0000 BF9C0000 BF9D0000 BF9E0000 BF9F0000
BFA00000 BFA10000 BFA20000 BFA30000 BFA40000
BFA50000 BFA60000 BFA70000 BFA80000 BFA90000
BFAA0000 BFAB0000 BFAC0000 BFAD0000 BFAE0000
BFAF0000 BFB00000 BFB10000 BFB20000 BFB30000
BFB40000 BFB50000 BFB60000 BFB70000 BFB80000
BFB90000 BFBA0000 BFBB0000 BFBC0000 BFBD0000
BFBE0000 BFBF0000 BFC00000 BFC10000 BFC20000
BFC30000 BFC40000 BFC50000 BFC60000 BFC70000
BFC80000 BFC90000 BFCA0000 BFCB0000 BFCC0000
BFCD0000 BFCE0000 BFCF0000 BFD00000 BFD10000
BFD20000 BFD30000 BFD40000 BFD50000 BFD60000
BFD70000 BFD80000 BFD90000 BFDA0000 BFDB0000
BFDC0000 BFDD0000 BFDE0000 BFDF0000 BFE00000
BFE10000 BFE20000 BFE30000 BFE40000 BFE50000
BFE60000 BFE70000 BFE80000 BFE90000 BFEA0000
BFEB0000 BFEC0000 BFED0000 BFEE0000 BFEF0000
BFF00000 BFF10000 BFF20000 BFF30000 BFF40000
BFF50000 BFF60000 BFF70000 BFF80000 BFF90000
BFFA0000 BFFB0000 BFFC0000 BFFD0000 BFFE0000
BFFF0000
Bank # 2:
flash-id : EF401800
Size: 16384 KB in 256 Sectors
Sector Start Addresses:
BE000000 BE010000 BE020000 BE030000 BE040000
BE050000 BE060000 BE070000 BE080000 BE090000
BE0A0000 BE0B0000 BE0C0000 BE0D0000 BE0E0000
BE0F0000 BE100000 BE110000 BE120000 BE130000
BE140000 BE150000 BE160000 BE170000 BE180000
BE190000 BE1A0000 BE1B0000 BE1C0000 BE1D0000
BE1E0000 BE1F0000 BE200000 BE210000 BE220000
BE230000 BE240000 BE250000 BE260000 BE270000
BE280000 BE290000 BE2A0000 BE2B0000 BE2C0000
BE2D0000 BE2E0000 BE2F0000 BE300000 BE310000
BE320000 BE330000 BE340000 BE350000 BE360000
BE370000 BE380000 BE390000 BE3A0000 BE3B0000
BE3C0000 BE3D0000 BE3E0000 BE3F0000 BE400000
BE410000 E BE420000 E BE430000 E BE440000 E BE450000 E
BE460000 E BE470000 E BE480000 E BE490000 E BE4A0000 E
BE4B0000 E BE4C0000 E BE4D0000 E BE4E0000 E BE4F0000 E
BE500000 E BE510000 E BE520000 E BE530000 E BE540000 E
BE550000 E BE560000 E BE570000 E BE580000 E BE590000 E
BE5A0000 E BE5B0000 E BE5C0000 E BE5D0000 E BE5E0000 E
BE5F0000 E BE600000 E BE610000 E BE620000 E BE630000 E
BE640000 E BE650000 E BE660000 E BE670000 E BE680000 E
BE690000 E BE6A0000 E BE6B0000 E BE6C0000 E BE6D0000 E
BE6E0000 E BE6F0000 E BE700000 E BE710000 E BE720000 E
BE730000 E BE740000 E BE750000 E BE760000 E BE770000 E
BE780000 E BE790000 E BE7A0000 E BE7B0000 E BE7C0000 E
BE7D0000 E BE7E0000 E
ar7100> imls
Image at BF060000:
Image Name: MIPS Linux Kernel Image
Created: 2011-12-20 4:33:01 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 958722 Bytes = 936.3 kB
Load Address: 80002000
Entry Point: 801fb6d0
Verifying Checksum ... crc32_fw: bf060040 - bf14a141 (len:000ea102) calc...
crc32_fw: range1 bf060040 - bf14a141
OK
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-11-27 1:27 Drassal, Allan
@ 2012-11-28 0:16 ` Daniel Schwierzeck
2012-11-28 13:21 ` Drassal, Allan
0 siblings, 1 reply; 16+ messages in thread
From: Daniel Schwierzeck @ 2012-11-28 0:16 UTC (permalink / raw)
To: u-boot
Hi Allan,
2012/11/27 Drassal, Allan <drasal@wsu.edu>:
> I am attempting to create a U-Boot image for a router, Buffalo WZR-HP-AG300H, details can be found here, http://wiki.openwrt.org/toh/buffalo/wzr-hp-ag300h.
>
> I am having trouble compiling and/or finding a pre-compiled version of U-Boot for it.
>
> I am attempting to recover a router that has its bootloader erased, I have an identical router that is functioning and have debug access through JTAG to both devices.
have you tried to dump the MTD partition of U-Boot on the working device?
> I located one image on the internet 8Muboot_RAM_version.bin, and loaded it into ram and executed it, but I don't receive any serial output, but it does turn on one LED indicator on the board, indicating that the program did execute somewhat. This was built for the AR724x processor though, and might be why it is not functioning fully.
Do you know the original text base address of that binary? If you load
the binary to the wrong address, function calls or relocation will not
work.
>
> I have attempted to halt the running board in the bootup, copy the ram contents from one board to the other, and resume the processor, but it seems I am missing something.
maybe there are cache coherency problems or the memory controller is
not initialized correctly
> I am going to paste below the contents of the openocd file that I am using, along with the initial startup of the working board. I can also provide any other details that are helpful.
>
> If I can build a working RAM startup image, that would be great, I can then use that to rewrite the onboard flash memory, or if I can directly access the flash memory through the JTAG, but so far, I have not been successful with that either.
>
> I believe I have a working toolchain to build U-Boot, but keep running into odd errors when building possibly due to different toolchain versions.
> Any help or assistance would be greatly appreciated.
>
> Thanks,
> Allan Drassal
>
> ar71xx.cfg
>
> # Atheros AR71xx MIPS 24Kc SoC.
> # tested on PB44 refererence board
>
> adapter_nsrst_delay 100
> jtag_ntrst_delay 100
>
> reset_config trst_and_srst
>
> set CHIPNAME ar71xx
>
> jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1
>
> set TARGETNAME $CHIPNAME.cpu
> target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
>
> $TARGETNAME configure -event reset-halt-post {
> #setup PLL to lowest common denominator 300/300/150 setting
> #mww 0xb8050000 0x000f40a3 ;# reset val + CPU:3 DDR:3 AHB:0
> #mww 0xb8050000 0x800f40a3 ;# send to PLL
> mww 0xb8050000 0x40140180 ;# reset val + CPU:3 DDR:3 AHB:0
> mww 0xb8050000 0xc0140180 ;# send to PLL
>
> #next command will reset for PLL changes to take effect
> mww 0xb8050008 3 ;# set reset_switch and clock_switch (resets SoC)
> }
>
> $TARGETNAME configure -event reset-init {
> #complete pll initialization
> mww 0xb8050000 0x800f0080 ;# set sw_update bit
> mww 0xb8050008 0 ;# clear reset_switch bit
> mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
> mww 0xb8050008 1 ;# set clock_switch bit
> sleep 1 ;# wait for lock
>
> # Setup DDR config and flash mapping
> mww 0xb8000000 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> mww 0xb8000004 0x812cd6a8 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
> #mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> #mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
>
> mww 0xb8000010 8 ;# force precharge all banks
> mww 0xb8000010 1 ;# force EMRS update cycle
> mww 0xb800000c 0 ;# clr ext. mode register
> mww 0xb8000010 2 ;# force auto refresh all banks
> mww 0xb8000010 8 ;# force precharge all banks
> #mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
> mww 0xb8000008 0x33 ;# set DDR mode value CAS=3
> mww 0xb8000010 1 ;# force EMRS update cycle
> #mww 0xb8000014 0x461b ;# DDR refresh value
> #mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value (16bit: 0xffff)
> mww 0xb8000014 0x44a6 ;# DDR refresh value
> mww 0xb8000018 0x00ff ;# DDR Read Data This Cycle value (16bit: 0xffff)
> mww 0xb800001c 0x7 ;# delay added to the DQS line (normal = 7)
> mww 0xb8000020 7
> mww 0xb8000024 7
> mww 0xb8000028 7
> }
are there no registers for enabling/disabling the memory controller?
Usually you need to disable
a memory controller when changing its configuration and to enable it
to start the
initialization sequence for the DRAM device.
>
> # setup working area somewhere in RAM
> $TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
>
> # serial SPI capable flash
> # flash bank <driver> <base> <size> <chip_width> <bus_width>
>
>
>
>
> commands used in openocd through a telnet connection to 127.0.0.1 4444:
> reset
> halt
> reset
> mww 0xb8060008 3
> mww 0xb806000c 0x12c
> halt
> mww 0xb8050000 0x00090828
> mww 0xb8050000 0x00050828
> mww 0xb8050000 0x00040828
> mww 0xb8050008 2
> mww 0xb8050008 3
> halt
> reset init
> load_image 8Muboot_RAM_version.bin 0x80000000
> resume 0x80000000
>
are you sure that 0x80000000 is the real text base address? The
mainline U-Boot code
uses 0x80000000 + CONFIG_SYS_INIT_SP_OFFSET as initial stack area
before relocation.
--
Best regards,
Daniel
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-11-28 0:16 ` Daniel Schwierzeck
@ 2012-11-28 13:21 ` Drassal, Allan
0 siblings, 0 replies; 16+ messages in thread
From: Drassal, Allan @ 2012-11-28 13:21 UTC (permalink / raw)
To: u-boot
> -----Original Message-----
> From: Daniel Schwierzeck [mailto:daniel.schwierzeck at gmail.com]
> Sent: Wednesday, November 28, 2012 9:16 AM
> To: Drassal, Allan
> Cc: u-boot at lists.denx.de
> Subject: Re: [U-Boot] U-Boot for MIPS AR7161
>
> Hi Allan,
>
> 2012/11/27 Drassal, Allan <drasal@wsu.edu>:
> > I am attempting to create a U-Boot image for a router, Buffalo
> WZR-HP-AG300H, details can be found here,
> http://wiki.openwrt.org/toh/buffalo/wzr-hp-ag300h.
> >
> > I am having trouble compiling and/or finding a pre-compiled version of
> U-Boot for it.
> >
> > I am attempting to recover a router that has its bootloader erased, I
> have an identical router that is functioning and have debug access through
> JTAG to both devices.
>
> have you tried to dump the MTD partition of U-Boot on the working device?
I have dumped all the partitions from the working device from the linux console onto a USB memory stick.
>
> > I located one image on the internet 8Muboot_RAM_version.bin, and loaded
> it into ram and executed it, but I don't receive any serial output, but
> it does turn on one LED indicator on the board, indicating that the program
> did execute somewhat. This was built for the AR724x processor though, and
> might be why it is not functioning fully.
>
> Do you know the original text base address of that binary? If you load
> the binary to the wrong address, function calls or relocation will not
> work.
>
The original base address is mapped to flash memory, I believe it is 0xbfc03860.
This is the first address the processor looks to upon startup I believe.
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
@ 2012-11-28 16:09 Dmytro
2012-11-29 9:21 ` Luka Perkov
0 siblings, 1 reply; 16+ messages in thread
From: Dmytro @ 2012-11-28 16:09 UTC (permalink / raw)
To: u-boot
> commands used in openocd through a telnet connection to 127.0.0.1 4444:
> reset
> halt
> reset
> mww 0xb8060008 3
> mww 0xb806000c 0x12c
> halt
> mww 0xb8050000 0x00090828
> mww 0xb8050000 0x00050828
> mww 0xb8050000 0x00040828
> mww 0xb8050008 2
> mww 0xb8050008 3
> halt
> reset init
> load_image 8Muboot_RAM_version.bin 0x80000000
> resume 0x80000000
First:
You somehow use the initialization commands from ar724x CPU for ar71xx
CPU. If you do not see the difference, you do not understand what you
count. You already have a configuration file ar71xx.cfg <= it enough.
The fact that a ar71xx nSRST (unlike ar724x, where nSRST replaced by
RST). The difference is significant for a soft reset / restart the
processor.
I also do not see a response from the CPU when you transfer mode
processor reset or halt, probably something you have not connected
properly. Or launch openocd incorrectly (not set the program
configuration file for CPU).
Secondly:
You'll probably need your own loader platform AP96 modified so that it
removed all the prerequisites for restarting the processor at boot
uboot. Also in the source of any processor is a function of
LOWLEVEL_INIT, it is virtually repeated initialization ar71xx.cfg, so
this function must be disabled or removed to the new RAM bootloader
version, as if it will stay, we just reboot the processor@boot
uboot via jtag.
Considering your experience and knowledge, I suggest you just unsolder
flash memory and an external programmer to flash it.
But if all you have decided to go to the end, or you need a JTAG
fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform),
so you can make the example of his version of the loader for AR71xx
(AP96 platform).
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-11-28 16:09 [U-Boot] U-Boot for MIPS AR7161 Dmytro
@ 2012-11-29 9:21 ` Luka Perkov
2012-11-29 13:23 ` Drassal, Allan
0 siblings, 1 reply; 16+ messages in thread
From: Luka Perkov @ 2012-11-29 9:21 UTC (permalink / raw)
To: u-boot
Hi Dmytro,
On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote:
> But if all you have decided to go to the end, or you need a JTAG
> fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform),
> so you can make the example of his version of the loader for AR71xx
> (AP96 platform).
Please show us your patch.
Luka
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-11-29 9:21 ` Luka Perkov
@ 2012-11-29 13:23 ` Drassal, Allan
2012-12-01 0:11 ` Dmytro
0 siblings, 1 reply; 16+ messages in thread
From: Drassal, Allan @ 2012-11-29 13:23 UTC (permalink / raw)
To: u-boot
Dear Dmytro and others,
Sorry, I didn't post the output in the previous post, just the commands.
I am going to post the full output below, along with the details of the ar71xx.cfg file, and output from openocd also.
The config file originally came from an AR724x processor as well, so it might not be correct for an AR71xx.
I would appreciate assistance in identifying the mistakes and correcting them if you don't mind please.
Please share with myself and others if you can.
The code that I am attempting to run in the processor, again for the AR724x, is 8Muboot_RAM_version.bin
It can be found easily on the internet with a google search. If you have the expertise to identify what can be changed to make this compatile with the AR71xx, please do.
This code partially runs because upon execution, it turns on an LED on the board. However, it gives no UART output that I can see.
I am still interested in porting U-Boot to this processor as well, and I have found bits and pieces of previous work done, but nothing that I can identify as compelte.
MIPS does not seem to be in the main line for U-Boot, but I might be mistaken, correct me if I am wrong here.
My experience is limited with MIPS archetecture, but I would be willing to assist in a port, and testing on the hardware that I have.
Thanks,
Allan Drassal
output from openocd, (./bin/openocd -f interface/sheevaplug.cfg -f ar71xx.cfg):
Open On-Chip Debugger 0.6.1 (2012-11-23-20:49)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter speed: 1000 kHz
adapter_nsrst_delay: 100
jtag_ntrst_delay: 100
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
131072
Info : clock speed 1000 kHz
Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
Info : accepting 'telnet' connection from 4444
Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
Warn : target not halted
in procedure 'mww'
Warn : target not halted
in procedure 'mww'
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
in procedure 'mww'
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
262144 bytes written at address 0x80000000
downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
output from the telnet session (telnet 127.0.0.1 4444):
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Open On-Chip Debugger
> reset
JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> reset
JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
> mww 0xb8060008 3
target not halted
in procedure 'mww'
> mww 0xb806000c 0x12c
target not halted
in procedure 'mww'
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> mww 0xb8050000 0x00090828
> mww 0xb8050000 0x00050828
> mww 0xb8050000 0x00040828
> mww 0xb8050008 2
> mww 0xb8050008 3
in procedure 'mww'
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> reset init
JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
> load_image 8Muboot_RAM_version.bin 0x80000000
262144 bytes written at address 0x80000000
downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
> resume 0x80000000
>
ar71xx.cfg:
# Atheros AR71xx MIPS 24Kc SoC.
# tested on PB44 refererence board
adapter_nsrst_delay 100
jtag_ntrst_delay 100
reset_config trst_and_srst
set CHIPNAME ar71xx
jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1
set TARGETNAME $CHIPNAME.cpu
target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
$TARGETNAME configure -event reset-halt-post {
#setup PLL to lowest common denominator 300/300/150 setting
mww 0xb8050000 0x40140180 ;# reset val + CPU:3 DDR:3 AHB:0
mww 0xb8050000 0xc0140180 ;# send to PLL
#next command will reset for PLL changes to take effect
mww 0xb8050008 3 ;# set reset_switch and clock_switch (resets SoC)
}
$TARGETNAME configure -event reset-init {
#complete pll initialization
mww 0xb8050000 0x800f0080 ;# set sw_update bit
mww 0xb8050008 0 ;# clear reset_switch bit
mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
mww 0xb8050008 1 ;# set clock_switch bit
sleep 1 ;# wait for lock
# Setup DDR config and flash mapping
mww 0xb8000000 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0)
mww 0xb8000004 0x812cd6a8 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
#mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
#mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
mww 0xb8000010 8 ;# force precharge all banks
mww 0xb8000010 1 ;# force EMRS update cycle
mww 0xb800000c 0 ;# clr ext. mode register
mww 0xb8000010 2 ;# force auto refresh all banks
mww 0xb8000010 8 ;# force precharge all banks
#mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
mww 0xb8000008 0x33 ;# set DDR mode value CAS=3
mww 0xb8000010 1 ;# force EMRS update cycle
#mww 0xb8000014 0x461b ;# DDR refresh value
#mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value (16bit: 0xffff)
mww 0xb8000014 0x44a6 ;# DDR refresh value
mww 0xb8000018 0x00ff ;# DDR Read Data This Cycle value (16bit: 0xffff)
mww 0xb800001c 0x7 ;# delay added to the DQS line (normal = 7)
mww 0xb8000020 7
mww 0xb8000024 7
mww 0xb8000028 7
}
# setup working area somewhere in RAM
$TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
# serial SPI capable flash
# flash bank <driver> <base> <size> <chip_width> <bus_width>
________________________________________
From: Luka Perkov [luka at openwrt.org]
Sent: Thursday, November 29, 2012 01:21
To: Dmytro
Cc: Drassal, Allan; U-Boot Mailing List
Subject: Re: [U-Boot] U-Boot for MIPS AR7161
Hi Dmytro,
On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote:
> But if all you have decided to go to the end, or you need a JTAG
> fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform),
> so you can make the example of his version of the loader for AR71xx
> (AP96 platform).
Please show us your patch.
Luka
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-11-29 13:23 ` Drassal, Allan
@ 2012-12-01 0:11 ` Dmytro
2012-12-01 4:14 ` Drassal, Allan
0 siblings, 1 reply; 16+ messages in thread
From: Dmytro @ 2012-12-01 0:11 UTC (permalink / raw)
To: u-boot
Hi Allan Drassal,
Frankly, I'm not in practice faced ar71xx processors in labs, but I
can give details on experience with the ar724x CPUs.
First we need to determine are fully is support in ar71xx.cfg file for
your device.
You need connect to the JTAG and switch the device in halt mode. Next
read the following registers using OpenOCD:
mdw 0xb8000000 0x10
mdw 0xb8050000
mdw 0xb8050008
mdw 0xb805000c
On the second device with a working firmware, do the same thing, only
in u-boot (it's as though after the initialization of the CPU):
md 0xb8000000 0x10
md 0xb8050000 0x1
md 0xb8050008 0x1
md 0xb805000c 0x1
What is it for?
Before initializing the processor - PLL records are in resetting state
These values are described in the files ar71xx.cfg or ar724x.cfg in
parentheses. Then based on these (reset) values are any operation
with PLL. I.e. We do not just give to known command to processor - We
read from the processor value and produce a binary operation on it
according to the rules described in the source lowlevel_init (if you
take the PLL). The same thing with the any initialization process.
Need will explain how to work with ar71xx.cfg configuration file.
Event "reset-halt-post" thegas telnet command "reset halt"
but this command directly related to the physical nSRST. I.e. During
the execution of commands "reset halt" - nSRTS goes to logic "1" at
the same time, this processor receives commands switch to "halt". In
my experience on ar724x CPUs - is no longer used nSRTS and has been
replaced on RST so "reset halt" does not work in my case and the
difficulty I had was that it was necessary to make sure that the
processor is switched to the correct mode, and it was settings needed
register (make sure you can read the "mdw 0xb8050000 "after the event
is triggered and you will once again transferred CPU in halt mode.).
As a last resort you can do "ar71xx.cpu invoke-event
reset-halt-post "(if not work "reset halt" as it should) for example
in the instructions:
http://www.google.com/translate_c?langpair=ru|en&u=http://wiki.openwrt.org/ru/toh/tp-link/tl-mr3420/debrick%2525using%2525jtag
The next step will be a check memory:
You need to load the image in the memory at 0xa0010000
load_image iamge.bin 0xa0010000
(Address window of DRAM memory at the platform AP96, PB42, etc. - 0xa0010000)
and most importantly, it immediately check and compare with the
original in HEX mode
mdw 0xa0010000 0x10
mdw 0xa0010000 0x10
(check 2 times)
This is due to the fact that If the specified is not correct timings
for the memory then the first read memory may even be quite normal,
but when we re-reading data, the data may already be offset (and
eventually, the data starts, as if to float). Usually corrects this
problem by selecting values in the less side DQS0, DQS1 line.
Bootloader 8Muboot_RAM_version.bin course is not suitable for your
purpose, you need to compile the bootloader for your platform and your
address space (0xa0010000). So far the only thing I can say about it -
I'm trying to solve this problem and will soon let you know the
results.
P.S.
As variants, there are plenty of opportunities to find the right boot
for your processor, for example there is a recovery function for
COMPEX devices:
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/How% 20to% 20JTAG% 20to%
20Compex% 20Loader.pdf
(Instruction)
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/upbios.tst
(needed file for flash via tftp (without UART))
https://dev.openwrt.org/attachment/ticket/8393/init-ar7130-32m.mac
(config for OCD Commande - can easily be changed to OpenOCD)
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/wp543.rar
(bootloader for ar7130)
http://www.cpx.cz/dls/wpe72_WPE72NX_MMJ5N26E/wp72_loader_jtag.zip
(as bonus this for ar724x - not tested with me)
Regards, Dmytro
2012/11/29, Drassal, Allan <drasal@wsu.edu>:
> Dear Dmytro and others,
>
> Sorry, I didn't post the output in the previous post, just the commands.
> I am going to post the full output below, along with the details of the
> ar71xx.cfg file, and output from openocd also.
> The config file originally came from an AR724x processor as well, so it
> might not be correct for an AR71xx.
> I would appreciate assistance in identifying the mistakes and correcting
> them if you don't mind please.
> Please share with myself and others if you can.
>
> The code that I am attempting to run in the processor, again for the AR724x,
> is 8Muboot_RAM_version.bin
> It can be found easily on the internet with a google search. If you have
> the expertise to identify what can be changed to make this compatile with
> the AR71xx, please do.
> This code partially runs because upon execution, it turns on an LED on the
> board. However, it gives no UART output that I can see.
>
> I am still interested in porting U-Boot to this processor as well, and I
> have found bits and pieces of previous work done, but nothing that I can
> identify as compelte.
> MIPS does not seem to be in the main line for U-Boot, but I might be
> mistaken, correct me if I am wrong here.
> My experience is limited with MIPS archetecture, but I would be willing to
> assist in a port, and testing on the hardware that I have.
>
> Thanks,
> Allan Drassal
>
>
> output from openocd, (./bin/openocd -f interface/sheevaplug.cfg -f
> ar71xx.cfg):
> Open On-Chip Debugger 0.6.1 (2012-11-23-20:49)
> Licensed under GNU GPL v2
> For bug reports, read
> http://openocd.sourceforge.net/doc/doxygen/bugs.html
> Info : only one transport option; autoselect 'jtag'
> adapter speed: 1000 kHz
> adapter_nsrst_delay: 100
> jtag_ntrst_delay: 100
> trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
> 131072
> Info : clock speed 1000 kHz
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> Info : accepting 'telnet' connection from 4444
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> Warn : target not halted
> in procedure 'mww'
> Warn : target not halted
> in procedure 'mww'
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> in procedure 'mww'
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
> 262144 bytes written at address 0x80000000
> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>
>
> output from the telnet session (telnet 127.0.0.1 4444):
> Trying 127.0.0.1...
> Connected to 127.0.0.1.
> Escape character is '^]'.
> Open On-Chip Debugger
>> reset
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> reset
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
>> mww 0xb8060008 3
> target not halted
> in procedure 'mww'
>> mww 0xb806000c 0x12c
> target not halted
> in procedure 'mww'
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> mww 0xb8050000 0x00090828
>> mww 0xb8050000 0x00050828
>> mww 0xb8050000 0x00040828
>> mww 0xb8050008 2
>> mww 0xb8050008 3
> in procedure 'mww'
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> reset init
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
>> load_image 8Muboot_RAM_version.bin 0x80000000
> 262144 bytes written at address 0x80000000
> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>> resume 0x80000000
>>
>
>
>
> ar71xx.cfg:
> # Atheros AR71xx MIPS 24Kc SoC.
> # tested on PB44 refererence board
>
> adapter_nsrst_delay 100
> jtag_ntrst_delay 100
>
> reset_config trst_and_srst
>
> set CHIPNAME ar71xx
>
> jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id
> 1
>
> set TARGETNAME $CHIPNAME.cpu
> target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
>
> $TARGETNAME configure -event reset-halt-post {
> #setup PLL to lowest common denominator 300/300/150 setting
> mww 0xb8050000 0x40140180 ;# reset val + CPU:3 DDR:3 AHB:0
> mww 0xb8050000 0xc0140180 ;# send to PLL
>
> #next command will reset for PLL changes to take effect
> mww 0xb8050008 3 ;# set reset_switch and clock_switch (resets SoC)
> }
>
> $TARGETNAME configure -event reset-init {
> #complete pll initialization
> mww 0xb8050000 0x800f0080 ;# set sw_update bit
> mww 0xb8050008 0 ;# clear reset_switch bit
> mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
> mww 0xb8050008 1 ;# set clock_switch bit
> sleep 1 ;# wait for lock
>
> # Setup DDR config and flash mapping
> mww 0xb8000000 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> mww 0xb8000004 0x812cd6a8 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
> #mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> #mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
>
> mww 0xb8000010 8 ;# force precharge all banks
> mww 0xb8000010 1 ;# force EMRS update cycle
> mww 0xb800000c 0 ;# clr ext. mode register
> mww 0xb8000010 2 ;# force auto refresh all banks
> mww 0xb8000010 8 ;# force precharge all banks
> #mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
> mww 0xb8000008 0x33 ;# set DDR mode value CAS=3
> mww 0xb8000010 1 ;# force EMRS update cycle
> #mww 0xb8000014 0x461b ;# DDR refresh value
> #mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value (16bit:
> 0xffff)
> mww 0xb8000014 0x44a6 ;# DDR refresh value
> mww 0xb8000018 0x00ff ;# DDR Read Data This Cycle value (16bit:
> 0xffff)
> mww 0xb800001c 0x7 ;# delay added to the DQS line (normal =
> 7)
> mww 0xb8000020 7
> mww 0xb8000024 7
> mww 0xb8000028 7
> }
>
> # setup working area somewhere in RAM
> $TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
>
> # serial SPI capable flash
> # flash bank <driver> <base> <size> <chip_width> <bus_width>
>
>
>
> ________________________________________
> From: Luka Perkov [luka at openwrt.org]
> Sent: Thursday, November 29, 2012 01:21
> To: Dmytro
> Cc: Drassal, Allan; U-Boot Mailing List
> Subject: Re: [U-Boot] U-Boot for MIPS AR7161
>
> Hi Dmytro,
>
> On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote:
>> But if all you have decided to go to the end, or you need a JTAG
>> fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform),
>> so you can make the example of his version of the loader for AR71xx
>> (AP96 platform).
>
> Please show us your patch.
>
> Luka
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-12-01 0:11 ` Dmytro
@ 2012-12-01 4:14 ` Drassal, Allan
2012-12-01 6:10 ` Drassal, Allan
0 siblings, 1 reply; 16+ messages in thread
From: Drassal, Allan @ 2012-12-01 4:14 UTC (permalink / raw)
To: u-boot
Hi Dmytro,
Thanks for your detailed response. I corrected some details in the ar71xx.cfg file and am posting them below this message.
With this, I am convinced that my JTAG interface is working and the DRAM controller is getting setup correctly.
Now, I am just needing some code to load into the processor.
I would like to port U-Boot over to this platform, but it is a little above my experience level at the moment.
Perhaps it has already been done and I am not looking in the right place.
This platform is technically based on AP96 I believe though.
I connected up the two devices today and did these checks, these are the results...
However, the response from the two devices is slightly different...
You can see the results below...
I needed to do a "reset init" before the file would load successfully...
I assume the DRAM controller is initialized at this point and not if I just open up openOCD.
if I just did a straight "halt" without a "reset init", then the PC is different
On the non-functioning device I am assuming it begins to execute code at 0xbfc00380, but runs into something it can't execute and either loops or freezes there.
> reset
JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
results from broken device
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> mdw 0xb8000000 0x10
0xb8000000: 77bc8cd0 81d106a8 00000133 00000002 00000000 00002000 000000ff 00000081
0xb8000020: 00000081 00000081 00000081 00000000 00000000 00000000 00000000 00000000
> mdw 0xb8050000
0xb8050000: 001040a3
> mdw 0xb8050008
0xb8050008: 00000000
> mdw 0xb805000c
0xb805000c: 00000000
results from working device
ar7100> md 0xb8000000 0x10
b8000000: 77b8884e 812cd6a8 00000033 00000000 w..N.,.....3....
b8000010: 00000000 000044a6 000000ff 00000007 ......D.........
b8000020: 00000007 00000007 00000007 00000000 ................
b8000030: 00000000 00000000 00000000 00000000 ................
ar7100> md 0xb8050000 0x1
b8050000: c0140180 ....
ar7100> md 0xb8050008 0x1
b8050008: 00000000 ....
ar7100> md 0xb805000c 0x1
b805000c: 00000000 ....
ar7100>
results of loading a file and checking the read memory is the same
> reset init
JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
> load_image mtd0.bin 0xa0010000
327680 bytes written at address 0xa0010000
downloaded 327680 bytes in 3.917356s (81.688 KiB/s)
> mdw 0xa0010000 0x10
0xa0010000: 100000ff 00000000 100000fd 00000000 10000dbb 00000000 10000db9 00000000
0xa0010020: 10000db7 00000000 10000db5 00000000 10000db3 00000000 10000db1 00000000
> mdw 0xa0010000 0x10
0xa0010000: 100000ff 00000000 100000fd 00000000 10000dbb 00000000 10000db9 00000000
0xa0010020: 10000db7 00000000 10000db5 00000000 10000db3 00000000 10000db1 00000000
> mdw 0xa0010000 0x10
0xa0010000: 100000ff 00000000 100000fd 00000000 10000dbb 00000000 10000db9 00000000
0xa0010020: 10000db7 00000000 10000db5 00000000 10000db3 00000000 10000db1 00000000
ar71xx.cfg:
# Atheros AR71xx MIPS 24Kc SoC.
# tested on PB44 refererence board
adapter_nsrst_delay 100
jtag_ntrst_delay 100
reset_config trst_and_srst
set CHIPNAME ar71xx
jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1
set TARGETNAME $CHIPNAME.cpu
target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
$TARGETNAME configure -event reset-halt-post {
#setup PLL to lowest common denominator 300/300/150 setting
mww 0xb8050000 0x000f40a3 ;# reset val + CPU:3 DDR:3 AHB:0
mww 0xb8050000 0x800f40a3 ;# send to PLL
#next command will reset for PLL changes to take effect
mww 0xb8050008 3 ;# set reset_switch and clock_switch (resets SoC)
}
$TARGETNAME configure -event reset-init {
#complete pll initialization
mww 0xb8050000 0x800f0080 ;# set sw_update bit
mww 0xb8050008 0 ;# clear reset_switch bit
mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
mww 0xb8050008 1 ;# set clock_switch bit
sleep 1 ;# wait for lock
# Setup DDR config and flash mapping
mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
mww 0xb8000010 8 ;# force precharge all banks
mww 0xb8000010 1 ;# force EMRS update cycle
mww 0xb800000c 0 ;# clr ext. mode register
mww 0xb8000010 2 ;# force auto refresh all banks
mww 0xb8000010 8 ;# force precharge all banks
mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
mww 0xb8000010 1 ;# force EMRS update cycle
mww 0xb8000014 0x461b ;# DDR refresh value
mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value (16bit: 0xffff)
mww 0xb800001c 0x7 ;# delay added to the DQS line (normal = 7)
mww 0xb8000020 0
mww 0xb8000024 0
mww 0xb8000028 0
}
# setup working area somewhere in RAM
$TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
# serial SPI capable flash
# flash bank <driver> <base> <size> <chip_width> <bus_width>
________________________________________
From: Dmytro [dioptimizer at gmail.com]
Sent: Friday, November 30, 2012 16:11
To: Drassal, Allan
Cc: Luka Perkov; U-Boot Mailing List
Subject: Re: [U-Boot] U-Boot for MIPS AR7161
Hi Allan Drassal,
Frankly, I'm not in practice faced ar71xx processors in labs, but I
can give details on experience with the ar724x CPUs.
First we need to determine are fully is support in ar71xx.cfg file for
your device.
You need connect to the JTAG and switch the device in halt mode. Next
read the following registers using OpenOCD:
mdw 0xb8000000 0x10
mdw 0xb8050000
mdw 0xb8050008
mdw 0xb805000c
On the second device with a working firmware, do the same thing, only
in u-boot (it's as though after the initialization of the CPU):
md 0xb8000000 0x10
md 0xb8050000 0x1
md 0xb8050008 0x1
md 0xb805000c 0x1
What is it for?
Before initializing the processor - PLL records are in resetting state
These values are described in the files ar71xx.cfg or ar724x.cfg in
parentheses. Then based on these (reset) values are any operation
with PLL. I.e. We do not just give to known command to processor - We
read from the processor value and produce a binary operation on it
according to the rules described in the source lowlevel_init (if you
take the PLL). The same thing with the any initialization process.
Need will explain how to work with ar71xx.cfg configuration file.
Event "reset-halt-post" thegas telnet command "reset halt"
but this command directly related to the physical nSRST. I.e. During
the execution of commands "reset halt" - nSRTS goes to logic "1" at
the same time, this processor receives commands switch to "halt". In
my experience on ar724x CPUs - is no longer used nSRTS and has been
replaced on RST so "reset halt" does not work in my case and the
difficulty I had was that it was necessary to make sure that the
processor is switched to the correct mode, and it was settings needed
register (make sure you can read the "mdw 0xb8050000 "after the event
is triggered and you will once again transferred CPU in halt mode.).
As a last resort you can do "ar71xx.cpu invoke-event
reset-halt-post "(if not work "reset halt" as it should) for example
in the instructions:
http://www.google.com/translate_c?langpair=ru|en&u=http://wiki.openwrt.org/ru/toh/tp-link/tl-mr3420/debrick%2525using%2525jtag
The next step will be a check memory:
You need to load the image in the memory at 0xa0010000
load_image iamge.bin 0xa0010000
(Address window of DRAM memory at the platform AP96, PB42, etc. - 0xa0010000)
and most importantly, it immediately check and compare with the
original in HEX mode
mdw 0xa0010000 0x10
mdw 0xa0010000 0x10
(check 2 times)
This is due to the fact that If the specified is not correct timings
for the memory then the first read memory may even be quite normal,
but when we re-reading data, the data may already be offset (and
eventually, the data starts, as if to float). Usually corrects this
problem by selecting values in the less side DQS0, DQS1 line.
Bootloader 8Muboot_RAM_version.bin course is not suitable for your
purpose, you need to compile the bootloader for your platform and your
address space (0xa0010000). So far the only thing I can say about it -
I'm trying to solve this problem and will soon let you know the
results.
P.S.
As variants, there are plenty of opportunities to find the right boot
for your processor, for example there is a recovery function for
COMPEX devices:
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/How% 20to% 20JTAG% 20to%
20Compex% 20Loader.pdf
(Instruction)
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/upbios.tst
(needed file for flash via tftp (without UART))
https://dev.openwrt.org/attachment/ticket/8393/init-ar7130-32m.mac
(config for OCD Commande - can easily be changed to OpenOCD)
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/wp543.rar
(bootloader for ar7130)
http://www.cpx.cz/dls/wpe72_WPE72NX_MMJ5N26E/wp72_loader_jtag.zip
(as bonus this for ar724x - not tested with me)
Regards, Dmytro
2012/11/29, Drassal, Allan <drasal@wsu.edu>:
> Dear Dmytro and others,
>
> Sorry, I didn't post the output in the previous post, just the commands.
> I am going to post the full output below, along with the details of the
> ar71xx.cfg file, and output from openocd also.
> The config file originally came from an AR724x processor as well, so it
> might not be correct for an AR71xx.
> I would appreciate assistance in identifying the mistakes and correcting
> them if you don't mind please.
> Please share with myself and others if you can.
>
> The code that I am attempting to run in the processor, again for the AR724x,
> is 8Muboot_RAM_version.bin
> It can be found easily on the internet with a google search. If you have
> the expertise to identify what can be changed to make this compatile with
> the AR71xx, please do.
> This code partially runs because upon execution, it turns on an LED on the
> board. However, it gives no UART output that I can see.
>
> I am still interested in porting U-Boot to this processor as well, and I
> have found bits and pieces of previous work done, but nothing that I can
> identify as compelte.
> MIPS does not seem to be in the main line for U-Boot, but I might be
> mistaken, correct me if I am wrong here.
> My experience is limited with MIPS archetecture, but I would be willing to
> assist in a port, and testing on the hardware that I have.
>
> Thanks,
> Allan Drassal
>
>
> output from openocd, (./bin/openocd -f interface/sheevaplug.cfg -f
> ar71xx.cfg):
> Open On-Chip Debugger 0.6.1 (2012-11-23-20:49)
> Licensed under GNU GPL v2
> For bug reports, read
> http://openocd.sourceforge.net/doc/doxygen/bugs.html
> Info : only one transport option; autoselect 'jtag'
> adapter speed: 1000 kHz
> adapter_nsrst_delay: 100
> jtag_ntrst_delay: 100
> trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
> 131072
> Info : clock speed 1000 kHz
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> Info : accepting 'telnet' connection from 4444
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> Warn : target not halted
> in procedure 'mww'
> Warn : target not halted
> in procedure 'mww'
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> in procedure 'mww'
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
> 262144 bytes written at address 0x80000000
> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>
>
> output from the telnet session (telnet 127.0.0.1 4444):
> Trying 127.0.0.1...
> Connected to 127.0.0.1.
> Escape character is '^]'.
> Open On-Chip Debugger
>> reset
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> reset
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
>> mww 0xb8060008 3
> target not halted
> in procedure 'mww'
>> mww 0xb806000c 0x12c
> target not halted
> in procedure 'mww'
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> mww 0xb8050000 0x00090828
>> mww 0xb8050000 0x00050828
>> mww 0xb8050000 0x00040828
>> mww 0xb8050008 2
>> mww 0xb8050008 3
> in procedure 'mww'
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> reset init
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
>> load_image 8Muboot_RAM_version.bin 0x80000000
> 262144 bytes written at address 0x80000000
> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>> resume 0x80000000
>>
>
>
>
> ar71xx.cfg:
> # Atheros AR71xx MIPS 24Kc SoC.
> # tested on PB44 refererence board
>
> adapter_nsrst_delay 100
> jtag_ntrst_delay 100
>
> reset_config trst_and_srst
>
> set CHIPNAME ar71xx
>
> jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id
> 1
>
> set TARGETNAME $CHIPNAME.cpu
> target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
>
> $TARGETNAME configure -event reset-halt-post {
> #setup PLL to lowest common denominator 300/300/150 setting
> mww 0xb8050000 0x40140180 ;# reset val + CPU:3 DDR:3 AHB:0
> mww 0xb8050000 0xc0140180 ;# send to PLL
>
> #next command will reset for PLL changes to take effect
> mww 0xb8050008 3 ;# set reset_switch and clock_switch (resets SoC)
> }
>
> $TARGETNAME configure -event reset-init {
> #complete pll initialization
> mww 0xb8050000 0x800f0080 ;# set sw_update bit
> mww 0xb8050008 0 ;# clear reset_switch bit
> mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
> mww 0xb8050008 1 ;# set clock_switch bit
> sleep 1 ;# wait for lock
>
> # Setup DDR config and flash mapping
> mww 0xb8000000 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> mww 0xb8000004 0x812cd6a8 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
> #mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> #mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
>
> mww 0xb8000010 8 ;# force precharge all banks
> mww 0xb8000010 1 ;# force EMRS update cycle
> mww 0xb800000c 0 ;# clr ext. mode register
> mww 0xb8000010 2 ;# force auto refresh all banks
> mww 0xb8000010 8 ;# force precharge all banks
> #mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
> mww 0xb8000008 0x33 ;# set DDR mode value CAS=3
> mww 0xb8000010 1 ;# force EMRS update cycle
> #mww 0xb8000014 0x461b ;# DDR refresh value
> #mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value (16bit:
> 0xffff)
> mww 0xb8000014 0x44a6 ;# DDR refresh value
> mww 0xb8000018 0x00ff ;# DDR Read Data This Cycle value (16bit:
> 0xffff)
> mww 0xb800001c 0x7 ;# delay added to the DQS line (normal =
> 7)
> mww 0xb8000020 7
> mww 0xb8000024 7
> mww 0xb8000028 7
> }
>
> # setup working area somewhere in RAM
> $TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
>
> # serial SPI capable flash
> # flash bank <driver> <base> <size> <chip_width> <bus_width>
>
>
>
> ________________________________________
> From: Luka Perkov [luka at openwrt.org]
> Sent: Thursday, November 29, 2012 01:21
> To: Dmytro
> Cc: Drassal, Allan; U-Boot Mailing List
> Subject: Re: [U-Boot] U-Boot for MIPS AR7161
>
> Hi Dmytro,
>
> On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote:
>> But if all you have decided to go to the end, or you need a JTAG
>> fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform),
>> so you can make the example of his version of the loader for AR71xx
>> (AP96 platform).
>
> Please show us your patch.
>
> Luka
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-12-01 4:14 ` Drassal, Allan
@ 2012-12-01 6:10 ` Drassal, Allan
2012-12-02 5:30 ` Dmytro
0 siblings, 1 reply; 16+ messages in thread
From: Drassal, Allan @ 2012-12-01 6:10 UTC (permalink / raw)
To: u-boot
I think I made a little more progress...
Using the following commands I can get output from the UART...
# set GPIO 9 & 10 as UART
mww 0xb8040000 0x400
mww 0xb8040028 0x100
mww 0xb8020004 0x0
mww 0xb802000c 0x83
mww 0xb8020000 0x51
mww 0xb8020004 0x0
mww 0xb802000c 0x3
mww 0xb8020008 0xc1
mww 0xb8020000 0x54
mww 0xb8020000 0x45
mww 0xb8020000 0x53
mww 0xb8020000 0x54
mww 0xb8020000 0x0D
mww 0xb8020000 0x0A
After executing the first two commands, then running the loader program I can get UART output, but it is all garbled.
It is like I have not selected the correct BAUD, but I have tried all speeds.
Possibly there is a mismatch in the internal clock calibration and the way the loader is calculating UART speeds.
Is this the PLL configuration that I should be looking at?
________________________________________
From: u-boot-bounces@lists.denx.de [u-boot-bounces at lists.denx.de] on behalf of Drassal, Allan [drasal at wsu.edu]
Sent: Friday, November 30, 2012 20:14
To: Dmytro
Cc: Luka Perkov; U-Boot Mailing List
Subject: Re: [U-Boot] U-Boot for MIPS AR7161
Hi Dmytro,
Thanks for your detailed response. I corrected some details in the ar71xx.cfg file and am posting them below this message.
With this, I am convinced that my JTAG interface is working and the DRAM controller is getting setup correctly.
Now, I am just needing some code to load into the processor.
I would like to port U-Boot over to this platform, but it is a little above my experience level at the moment.
Perhaps it has already been done and I am not looking in the right place.
This platform is technically based on AP96 I believe though.
I connected up the two devices today and did these checks, these are the results...
However, the response from the two devices is slightly different...
You can see the results below...
I needed to do a "reset init" before the file would load successfully...
I assume the DRAM controller is initialized at this point and not if I just open up openOCD.
if I just did a straight "halt" without a "reset init", then the PC is different
On the non-functioning device I am assuming it begins to execute code at 0xbfc00380, but runs into something it can't execute and either loops or freezes there.
> reset
JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
results from broken device
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> mdw 0xb8000000 0x10
0xb8000000: 77bc8cd0 81d106a8 00000133 00000002 00000000 00002000 000000ff 00000081
0xb8000020: 00000081 00000081 00000081 00000000 00000000 00000000 00000000 00000000
> mdw 0xb8050000
0xb8050000: 001040a3
> mdw 0xb8050008
0xb8050008: 00000000
> mdw 0xb805000c
0xb805000c: 00000000
results from working device
ar7100> md 0xb8000000 0x10
b8000000: 77b8884e 812cd6a8 00000033 00000000 w..N.,.....3....
b8000010: 00000000 000044a6 000000ff 00000007 ......D.........
b8000020: 00000007 00000007 00000007 00000000 ................
b8000030: 00000000 00000000 00000000 00000000 ................
ar7100> md 0xb8050000 0x1
b8050000: c0140180 ....
ar7100> md 0xb8050008 0x1
b8050008: 00000000 ....
ar7100> md 0xb805000c 0x1
b805000c: 00000000 ....
ar7100>
results of loading a file and checking the read memory is the same
> reset init
JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
> load_image mtd0.bin 0xa0010000
327680 bytes written at address 0xa0010000
downloaded 327680 bytes in 3.917356s (81.688 KiB/s)
> mdw 0xa0010000 0x10
0xa0010000: 100000ff 00000000 100000fd 00000000 10000dbb 00000000 10000db9 00000000
0xa0010020: 10000db7 00000000 10000db5 00000000 10000db3 00000000 10000db1 00000000
> mdw 0xa0010000 0x10
0xa0010000: 100000ff 00000000 100000fd 00000000 10000dbb 00000000 10000db9 00000000
0xa0010020: 10000db7 00000000 10000db5 00000000 10000db3 00000000 10000db1 00000000
> mdw 0xa0010000 0x10
0xa0010000: 100000ff 00000000 100000fd 00000000 10000dbb 00000000 10000db9 00000000
0xa0010020: 10000db7 00000000 10000db5 00000000 10000db3 00000000 10000db1 00000000
ar71xx.cfg:
# Atheros AR71xx MIPS 24Kc SoC.
# tested on PB44 refererence board
adapter_nsrst_delay 100
jtag_ntrst_delay 100
reset_config trst_and_srst
set CHIPNAME ar71xx
jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1
set TARGETNAME $CHIPNAME.cpu
target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
$TARGETNAME configure -event reset-halt-post {
#setup PLL to lowest common denominator 300/300/150 setting
mww 0xb8050000 0x000f40a3 ;# reset val + CPU:3 DDR:3 AHB:0
mww 0xb8050000 0x800f40a3 ;# send to PLL
#next command will reset for PLL changes to take effect
mww 0xb8050008 3 ;# set reset_switch and clock_switch (resets SoC)
}
$TARGETNAME configure -event reset-init {
#complete pll initialization
mww 0xb8050000 0x800f0080 ;# set sw_update bit
mww 0xb8050008 0 ;# clear reset_switch bit
mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
mww 0xb8050008 1 ;# set clock_switch bit
sleep 1 ;# wait for lock
# Setup DDR config and flash mapping
mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
mww 0xb8000010 8 ;# force precharge all banks
mww 0xb8000010 1 ;# force EMRS update cycle
mww 0xb800000c 0 ;# clr ext. mode register
mww 0xb8000010 2 ;# force auto refresh all banks
mww 0xb8000010 8 ;# force precharge all banks
mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
mww 0xb8000010 1 ;# force EMRS update cycle
mww 0xb8000014 0x461b ;# DDR refresh value
mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value (16bit: 0xffff)
mww 0xb800001c 0x7 ;# delay added to the DQS line (normal = 7)
mww 0xb8000020 0
mww 0xb8000024 0
mww 0xb8000028 0
}
# setup working area somewhere in RAM
$TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
# serial SPI capable flash
# flash bank <driver> <base> <size> <chip_width> <bus_width>
________________________________________
From: Dmytro [dioptimizer at gmail.com]
Sent: Friday, November 30, 2012 16:11
To: Drassal, Allan
Cc: Luka Perkov; U-Boot Mailing List
Subject: Re: [U-Boot] U-Boot for MIPS AR7161
Hi Allan Drassal,
Frankly, I'm not in practice faced ar71xx processors in labs, but I
can give details on experience with the ar724x CPUs.
First we need to determine are fully is support in ar71xx.cfg file for
your device.
You need connect to the JTAG and switch the device in halt mode. Next
read the following registers using OpenOCD:
mdw 0xb8000000 0x10
mdw 0xb8050000
mdw 0xb8050008
mdw 0xb805000c
On the second device with a working firmware, do the same thing, only
in u-boot (it's as though after the initialization of the CPU):
md 0xb8000000 0x10
md 0xb8050000 0x1
md 0xb8050008 0x1
md 0xb805000c 0x1
What is it for?
Before initializing the processor - PLL records are in resetting state
These values are described in the files ar71xx.cfg or ar724x.cfg in
parentheses. Then based on these (reset) values are any operation
with PLL. I.e. We do not just give to known command to processor - We
read from the processor value and produce a binary operation on it
according to the rules described in the source lowlevel_init (if you
take the PLL). The same thing with the any initialization process.
Need will explain how to work with ar71xx.cfg configuration file.
Event "reset-halt-post" thegas telnet command "reset halt"
but this command directly related to the physical nSRST. I.e. During
the execution of commands "reset halt" - nSRTS goes to logic "1" at
the same time, this processor receives commands switch to "halt". In
my experience on ar724x CPUs - is no longer used nSRTS and has been
replaced on RST so "reset halt" does not work in my case and the
difficulty I had was that it was necessary to make sure that the
processor is switched to the correct mode, and it was settings needed
register (make sure you can read the "mdw 0xb8050000 "after the event
is triggered and you will once again transferred CPU in halt mode.).
As a last resort you can do "ar71xx.cpu invoke-event
reset-halt-post "(if not work "reset halt" as it should) for example
in the instructions:
http://www.google.com/translate_c?langpair=ru|en&u=http://wiki.openwrt.org/ru/toh/tp-link/tl-mr3420/debrick%2525using%2525jtag
The next step will be a check memory:
You need to load the image in the memory at 0xa0010000
load_image iamge.bin 0xa0010000
(Address window of DRAM memory at the platform AP96, PB42, etc. - 0xa0010000)
and most importantly, it immediately check and compare with the
original in HEX mode
mdw 0xa0010000 0x10
mdw 0xa0010000 0x10
(check 2 times)
This is due to the fact that If the specified is not correct timings
for the memory then the first read memory may even be quite normal,
but when we re-reading data, the data may already be offset (and
eventually, the data starts, as if to float). Usually corrects this
problem by selecting values in the less side DQS0, DQS1 line.
Bootloader 8Muboot_RAM_version.bin course is not suitable for your
purpose, you need to compile the bootloader for your platform and your
address space (0xa0010000). So far the only thing I can say about it -
I'm trying to solve this problem and will soon let you know the
results.
P.S.
As variants, there are plenty of opportunities to find the right boot
for your processor, for example there is a recovery function for
COMPEX devices:
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/How% 20to% 20JTAG% 20to%
20Compex% 20Loader.pdf
(Instruction)
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/upbios.tst
(needed file for flash via tftp (without UART))
https://dev.openwrt.org/attachment/ticket/8393/init-ar7130-32m.mac
(config for OCD Commande - can easily be changed to OpenOCD)
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/wp543.rar
(bootloader for ar7130)
http://www.cpx.cz/dls/wpe72_WPE72NX_MMJ5N26E/wp72_loader_jtag.zip
(as bonus this for ar724x - not tested with me)
Regards, Dmytro
2012/11/29, Drassal, Allan <drasal@wsu.edu>:
> Dear Dmytro and others,
>
> Sorry, I didn't post the output in the previous post, just the commands.
> I am going to post the full output below, along with the details of the
> ar71xx.cfg file, and output from openocd also.
> The config file originally came from an AR724x processor as well, so it
> might not be correct for an AR71xx.
> I would appreciate assistance in identifying the mistakes and correcting
> them if you don't mind please.
> Please share with myself and others if you can.
>
> The code that I am attempting to run in the processor, again for the AR724x,
> is 8Muboot_RAM_version.bin
> It can be found easily on the internet with a google search. If you have
> the expertise to identify what can be changed to make this compatile with
> the AR71xx, please do.
> This code partially runs because upon execution, it turns on an LED on the
> board. However, it gives no UART output that I can see.
>
> I am still interested in porting U-Boot to this processor as well, and I
> have found bits and pieces of previous work done, but nothing that I can
> identify as compelte.
> MIPS does not seem to be in the main line for U-Boot, but I might be
> mistaken, correct me if I am wrong here.
> My experience is limited with MIPS archetecture, but I would be willing to
> assist in a port, and testing on the hardware that I have.
>
> Thanks,
> Allan Drassal
>
>
> output from openocd, (./bin/openocd -f interface/sheevaplug.cfg -f
> ar71xx.cfg):
> Open On-Chip Debugger 0.6.1 (2012-11-23-20:49)
> Licensed under GNU GPL v2
> For bug reports, read
> http://openocd.sourceforge.net/doc/doxygen/bugs.html
> Info : only one transport option; autoselect 'jtag'
> adapter speed: 1000 kHz
> adapter_nsrst_delay: 100
> jtag_ntrst_delay: 100
> trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
> 131072
> Info : clock speed 1000 kHz
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> Info : accepting 'telnet' connection from 4444
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> Warn : target not halted
> in procedure 'mww'
> Warn : target not halted
> in procedure 'mww'
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> in procedure 'mww'
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
> 262144 bytes written at address 0x80000000
> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>
>
> output from the telnet session (telnet 127.0.0.1 4444):
> Trying 127.0.0.1...
> Connected to 127.0.0.1.
> Escape character is '^]'.
> Open On-Chip Debugger
>> reset
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> reset
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
>> mww 0xb8060008 3
> target not halted
> in procedure 'mww'
>> mww 0xb806000c 0x12c
> target not halted
> in procedure 'mww'
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> mww 0xb8050000 0x00090828
>> mww 0xb8050000 0x00050828
>> mww 0xb8050000 0x00040828
>> mww 0xb8050008 2
>> mww 0xb8050008 3
> in procedure 'mww'
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> reset init
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
>> load_image 8Muboot_RAM_version.bin 0x80000000
> 262144 bytes written at address 0x80000000
> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>> resume 0x80000000
>>
>
>
>
> ar71xx.cfg:
> # Atheros AR71xx MIPS 24Kc SoC.
> # tested on PB44 refererence board
>
> adapter_nsrst_delay 100
> jtag_ntrst_delay 100
>
> reset_config trst_and_srst
>
> set CHIPNAME ar71xx
>
> jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id
> 1
>
> set TARGETNAME $CHIPNAME.cpu
> target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
>
> $TARGETNAME configure -event reset-halt-post {
> #setup PLL to lowest common denominator 300/300/150 setting
> mww 0xb8050000 0x40140180 ;# reset val + CPU:3 DDR:3 AHB:0
> mww 0xb8050000 0xc0140180 ;# send to PLL
>
> #next command will reset for PLL changes to take effect
> mww 0xb8050008 3 ;# set reset_switch and clock_switch (resets SoC)
> }
>
> $TARGETNAME configure -event reset-init {
> #complete pll initialization
> mww 0xb8050000 0x800f0080 ;# set sw_update bit
> mww 0xb8050008 0 ;# clear reset_switch bit
> mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
> mww 0xb8050008 1 ;# set clock_switch bit
> sleep 1 ;# wait for lock
>
> # Setup DDR config and flash mapping
> mww 0xb8000000 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> mww 0xb8000004 0x812cd6a8 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
> #mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> #mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst: 0x80d106a8)
>
> mww 0xb8000010 8 ;# force precharge all banks
> mww 0xb8000010 1 ;# force EMRS update cycle
> mww 0xb800000c 0 ;# clr ext. mode register
> mww 0xb8000010 2 ;# force auto refresh all banks
> mww 0xb8000010 8 ;# force precharge all banks
> #mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
> mww 0xb8000008 0x33 ;# set DDR mode value CAS=3
> mww 0xb8000010 1 ;# force EMRS update cycle
> #mww 0xb8000014 0x461b ;# DDR refresh value
> #mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value (16bit:
> 0xffff)
> mww 0xb8000014 0x44a6 ;# DDR refresh value
> mww 0xb8000018 0x00ff ;# DDR Read Data This Cycle value (16bit:
> 0xffff)
> mww 0xb800001c 0x7 ;# delay added to the DQS line (normal =
> 7)
> mww 0xb8000020 7
> mww 0xb8000024 7
> mww 0xb8000028 7
> }
>
> # setup working area somewhere in RAM
> $TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
>
> # serial SPI capable flash
> # flash bank <driver> <base> <size> <chip_width> <bus_width>
>
>
>
> ________________________________________
> From: Luka Perkov [luka at openwrt.org]
> Sent: Thursday, November 29, 2012 01:21
> To: Dmytro
> Cc: Drassal, Allan; U-Boot Mailing List
> Subject: Re: [U-Boot] U-Boot for MIPS AR7161
>
> Hi Dmytro,
>
> On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote:
>> But if all you have decided to go to the end, or you need a JTAG
>> fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform),
>> so you can make the example of his version of the loader for AR71xx
>> (AP96 platform).
>
> Please show us your patch.
>
> Luka
_______________________________________________
U-Boot mailing list
U-Boot at lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-12-01 6:10 ` Drassal, Allan
@ 2012-12-02 5:30 ` Dmytro
2012-12-02 10:20 ` Drassal, Allan
0 siblings, 1 reply; 16+ messages in thread
From: Dmytro @ 2012-12-02 5:30 UTC (permalink / raw)
To: u-boot
Hello again
Here I tried to create the bootloader.
http://dioptimizer.narod.ru/files/ap96/u-boot.bin
http://dioptimizer.narod.ru/files/ap96/u-boot.md5
For tftp:
192.168.1.1 -router ip
192.168.1.2 -must be your ethernet ip
It must be loaded into memory at address: 0xa0010000
Then in OpenOCD (telnet) put:
resume 0xa0010000
By the way you can check the boot on the work device, it's faster:
tftpboot 0xa0010000 u-boot.bin
go 0xa0010000
2012/12/1, Drassal, Allan <drasal@wsu.edu>:
> I think I made a little more progress...
> Using the following commands I can get output from the UART...
> # set GPIO 9 & 10 as UART
> mww 0xb8040000 0x400
> mww 0xb8040028 0x100
>
> mww 0xb8020004 0x0
> mww 0xb802000c 0x83
> mww 0xb8020000 0x51
> mww 0xb8020004 0x0
> mww 0xb802000c 0x3
> mww 0xb8020008 0xc1
>
> mww 0xb8020000 0x54
> mww 0xb8020000 0x45
> mww 0xb8020000 0x53
> mww 0xb8020000 0x54
> mww 0xb8020000 0x0D
> mww 0xb8020000 0x0A
>
> After executing the first two commands, then running the loader program I
> can get UART output, but it is all garbled.
> It is like I have not selected the correct BAUD, but I have tried all
> speeds.
> Possibly there is a mismatch in the internal clock calibration and the way
> the loader is calculating UART speeds.
> Is this the PLL configuration that I should be looking at?
> ________________________________________
> From: u-boot-bounces at lists.denx.de [u-boot-bounces at lists.denx.de] on behalf
> of Drassal, Allan [drasal at wsu.edu]
> Sent: Friday, November 30, 2012 20:14
> To: Dmytro
> Cc: Luka Perkov; U-Boot Mailing List
> Subject: Re: [U-Boot] U-Boot for MIPS AR7161
>
> Hi Dmytro,
>
> Thanks for your detailed response. I corrected some details in the
> ar71xx.cfg file and am posting them below this message.
> With this, I am convinced that my JTAG interface is working and the DRAM
> controller is getting setup correctly.
> Now, I am just needing some code to load into the processor.
> I would like to port U-Boot over to this platform, but it is a little above
> my experience level at the moment.
> Perhaps it has already been done and I am not looking in the right place.
> This platform is technically based on AP96 I believe though.
>
> I connected up the two devices today and did these checks, these are the
> results...
> However, the response from the two devices is slightly different...
> You can see the results below...
>
> I needed to do a "reset init" before the file would load successfully...
> I assume the DRAM controller is initialized at this point and not if I just
> open up openOCD.
> if I just did a straight "halt" without a "reset init", then the PC is
> different
>
> On the non-functioning device I am assuming it begins to execute code at
> 0xbfc00380, but runs into something it can't execute and either loops or
> freezes there.
>
>> reset
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>
>
> results from broken device
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> mdw 0xb8000000 0x10
> 0xb8000000: 77bc8cd0 81d106a8 00000133 00000002 00000000 00002000 000000ff
> 00000081
> 0xb8000020: 00000081 00000081 00000081 00000000 00000000 00000000 00000000
> 00000000
>> mdw 0xb8050000
> 0xb8050000: 001040a3
>> mdw 0xb8050008
> 0xb8050008: 00000000
>> mdw 0xb805000c
> 0xb805000c: 00000000
>
> results from working device
> ar7100> md 0xb8000000 0x10
> b8000000: 77b8884e 812cd6a8 00000033 00000000 w..N.,.....3....
> b8000010: 00000000 000044a6 000000ff 00000007 ......D.........
> b8000020: 00000007 00000007 00000007 00000000 ................
> b8000030: 00000000 00000000 00000000 00000000 ................
> ar7100> md 0xb8050000 0x1
> b8050000: c0140180 ....
> ar7100> md 0xb8050008 0x1
> b8050008: 00000000 ....
> ar7100> md 0xb805000c 0x1
> b805000c: 00000000 ....
> ar7100>
>
> results of loading a file and checking the read memory is the same
>> reset init
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
>> load_image mtd0.bin 0xa0010000
> 327680 bytes written at address 0xa0010000
> downloaded 327680 bytes in 3.917356s (81.688 KiB/s)
>> mdw 0xa0010000 0x10
> 0xa0010000: 100000ff 00000000 100000fd 00000000 10000dbb 00000000 10000db9
> 00000000
> 0xa0010020: 10000db7 00000000 10000db5 00000000 10000db3 00000000 10000db1
> 00000000
>> mdw 0xa0010000 0x10
> 0xa0010000: 100000ff 00000000 100000fd 00000000 10000dbb 00000000 10000db9
> 00000000
> 0xa0010020: 10000db7 00000000 10000db5 00000000 10000db3 00000000 10000db1
> 00000000
>> mdw 0xa0010000 0x10
> 0xa0010000: 100000ff 00000000 100000fd 00000000 10000dbb 00000000 10000db9
> 00000000
> 0xa0010020: 10000db7 00000000 10000db5 00000000 10000db3 00000000 10000db1
> 00000000
>
>
>
> ar71xx.cfg:
> # Atheros AR71xx MIPS 24Kc SoC.
> # tested on PB44 refererence board
>
> adapter_nsrst_delay 100
> jtag_ntrst_delay 100
>
> reset_config trst_and_srst
>
> set CHIPNAME ar71xx
>
> jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id
> 1
>
> set TARGETNAME $CHIPNAME.cpu
> target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
>
> $TARGETNAME configure -event reset-halt-post {
> #setup PLL to lowest common denominator 300/300/150 setting
> mww 0xb8050000 0x000f40a3 ;# reset val + CPU:3 DDR:3 AHB:0
> mww 0xb8050000 0x800f40a3 ;# send to PLL
>
> #next command will reset for PLL changes to take effect
> mww 0xb8050008 3 ;# set reset_switch and clock_switch
> (resets SoC)
> }
>
> $TARGETNAME configure -event reset-init {
> #complete pll initialization
> mww 0xb8050000 0x800f0080 ;# set sw_update bit
> mww 0xb8050008 0 ;# clear reset_switch bit
> mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
> mww 0xb8050008 1 ;# set clock_switch bit
> sleep 1 ;# wait for lock
>
> # Setup DDR config and flash mapping
> mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst:
> 0x80d106a8)
>
> mww 0xb8000010 8 ;# force precharge all banks
> mww 0xb8000010 1 ;# force EMRS update cycle
> mww 0xb800000c 0 ;# clr ext. mode register
> mww 0xb8000010 2 ;# force auto refresh all banks
> mww 0xb8000010 8 ;# force precharge all banks
> mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
> mww 0xb8000010 1 ;# force EMRS update cycle
> mww 0xb8000014 0x461b ;# DDR refresh value
> mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value
> (16bit: 0xffff)
> mww 0xb800001c 0x7 ;# delay added to the DQS line
> (normal = 7)
> mww 0xb8000020 0
> mww 0xb8000024 0
> mww 0xb8000028 0
> }
>
> # setup working area somewhere in RAM
> $TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
>
> # serial SPI capable flash
> # flash bank <driver> <base> <size> <chip_width> <bus_width>
>
> ________________________________________
> From: Dmytro [dioptimizer at gmail.com]
> Sent: Friday, November 30, 2012 16:11
> To: Drassal, Allan
> Cc: Luka Perkov; U-Boot Mailing List
> Subject: Re: [U-Boot] U-Boot for MIPS AR7161
>
> Hi Allan Drassal,
>
> Frankly, I'm not in practice faced ar71xx processors in labs, but I
> can give details on experience with the ar724x CPUs.
>
> First we need to determine are fully is support in ar71xx.cfg file for
> your device.
> You need connect to the JTAG and switch the device in halt mode. Next
> read the following registers using OpenOCD:
> mdw 0xb8000000 0x10
> mdw 0xb8050000
> mdw 0xb8050008
> mdw 0xb805000c
>
> On the second device with a working firmware, do the same thing, only
> in u-boot (it's as though after the initialization of the CPU):
> md 0xb8000000 0x10
> md 0xb8050000 0x1
> md 0xb8050008 0x1
> md 0xb805000c 0x1
>
> What is it for?
> Before initializing the processor - PLL records are in resetting state
> These values are described in the files ar71xx.cfg or ar724x.cfg in
> parentheses. Then based on these (reset) values are any operation
> with PLL. I.e. We do not just give to known command to processor - We
> read from the processor value and produce a binary operation on it
> according to the rules described in the source lowlevel_init (if you
> take the PLL). The same thing with the any initialization process.
>
> Need will explain how to work with ar71xx.cfg configuration file.
> Event "reset-halt-post" thegas telnet command "reset halt"
> but this command directly related to the physical nSRST. I.e. During
> the execution of commands "reset halt" - nSRTS goes to logic "1" at
> the same time, this processor receives commands switch to "halt". In
> my experience on ar724x CPUs - is no longer used nSRTS and has been
> replaced on RST so "reset halt" does not work in my case and the
> difficulty I had was that it was necessary to make sure that the
> processor is switched to the correct mode, and it was settings needed
> register (make sure you can read the "mdw 0xb8050000 "after the event
> is triggered and you will once again transferred CPU in halt mode.).
> As a last resort you can do "ar71xx.cpu invoke-event
> reset-halt-post "(if not work "reset halt" as it should) for example
> in the instructions:
> http://www.google.com/translate_c?langpair=ru|en&u=http://wiki.openwrt.org/ru/toh/tp-link/tl-mr3420/debrick%2525using%2525jtag
>
> The next step will be a check memory:
> You need to load the image in the memory at 0xa0010000
> load_image iamge.bin 0xa0010000
> (Address window of DRAM memory at the platform AP96, PB42, etc. -
> 0xa0010000)
> and most importantly, it immediately check and compare with the
> original in HEX mode
> mdw 0xa0010000 0x10
> mdw 0xa0010000 0x10
> (check 2 times)
> This is due to the fact that If the specified is not correct timings
> for the memory then the first read memory may even be quite normal,
> but when we re-reading data, the data may already be offset (and
> eventually, the data starts, as if to float). Usually corrects this
> problem by selecting values in the less side DQS0, DQS1 line.
>
> Bootloader 8Muboot_RAM_version.bin course is not suitable for your
> purpose, you need to compile the bootloader for your platform and your
> address space (0xa0010000). So far the only thing I can say about it -
> I'm trying to solve this problem and will soon let you know the
> results.
>
> P.S.
> As variants, there are plenty of opportunities to find the right boot
> for your processor, for example there is a recovery function for
> COMPEX devices:
> http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/How% 20to% 20JTAG% 20to%
> 20Compex% 20Loader.pdf
> (Instruction)
> http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/upbios.tst
> (needed file for flash via tftp (without UART))
> https://dev.openwrt.org/attachment/ticket/8393/init-ar7130-32m.mac
> (config for OCD Commande - can easily be changed to OpenOCD)
> http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/wp543.rar
> (bootloader for ar7130)
> http://www.cpx.cz/dls/wpe72_WPE72NX_MMJ5N26E/wp72_loader_jtag.zip
> (as bonus this for ar724x - not tested with me)
>
> Regards, Dmytro
>
> 2012/11/29, Drassal, Allan <drasal@wsu.edu>:
>> Dear Dmytro and others,
>>
>> Sorry, I didn't post the output in the previous post, just the commands.
>> I am going to post the full output below, along with the details of the
>> ar71xx.cfg file, and output from openocd also.
>> The config file originally came from an AR724x processor as well, so it
>> might not be correct for an AR71xx.
>> I would appreciate assistance in identifying the mistakes and correcting
>> them if you don't mind please.
>> Please share with myself and others if you can.
>>
>> The code that I am attempting to run in the processor, again for the
>> AR724x,
>> is 8Muboot_RAM_version.bin
>> It can be found easily on the internet with a google search. If you have
>> the expertise to identify what can be changed to make this compatile with
>> the AR71xx, please do.
>> This code partially runs because upon execution, it turns on an LED on
>> the
>> board. However, it gives no UART output that I can see.
>>
>> I am still interested in porting U-Boot to this processor as well, and I
>> have found bits and pieces of previous work done, but nothing that I can
>> identify as compelte.
>> MIPS does not seem to be in the main line for U-Boot, but I might be
>> mistaken, correct me if I am wrong here.
>> My experience is limited with MIPS archetecture, but I would be willing
>> to
>> assist in a port, and testing on the hardware that I have.
>>
>> Thanks,
>> Allan Drassal
>>
>>
>> output from openocd, (./bin/openocd -f interface/sheevaplug.cfg -f
>> ar71xx.cfg):
>> Open On-Chip Debugger 0.6.1 (2012-11-23-20:49)
>> Licensed under GNU GPL v2
>> For bug reports, read
>> http://openocd.sourceforge.net/doc/doxygen/bugs.html
>> Info : only one transport option; autoselect 'jtag'
>> adapter speed: 1000 kHz
>> adapter_nsrst_delay: 100
>> jtag_ntrst_delay: 100
>> trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
>> 131072
>> Info : clock speed 1000 kHz
>> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000,
>> part:
>> 0x0000, ver: 0x0)
>> Info : accepting 'telnet' connection from 4444
>> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000,
>> part:
>> 0x0000, ver: 0x0)
>> target state: halted
>> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000,
>> part:
>> 0x0000, ver: 0x0)
>> Warn : target not halted
>> in procedure 'mww'
>> Warn : target not halted
>> in procedure 'mww'
>> target state: halted
>> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> in procedure 'mww'
>> target state: halted
>> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000,
>> part:
>> 0x0000, ver: 0x0)
>> target state: halted
>> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
>> 262144 bytes written at address 0x80000000
>> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>>
>>
>> output from the telnet session (telnet 127.0.0.1 4444):
>> Trying 127.0.0.1...
>> Connected to 127.0.0.1.
>> Escape character is '^]'.
>> Open On-Chip Debugger
>>> reset
>> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
>> 0x0000,
>> ver: 0x0)
>>> halt
>> target state: halted
>> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>>> reset
>> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
>> 0x0000,
>> ver: 0x0)
>>> mww 0xb8060008 3
>> target not halted
>> in procedure 'mww'
>>> mww 0xb806000c 0x12c
>> target not halted
>> in procedure 'mww'
>>> halt
>> target state: halted
>> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>>> mww 0xb8050000 0x00090828
>>> mww 0xb8050000 0x00050828
>>> mww 0xb8050000 0x00040828
>>> mww 0xb8050008 2
>>> mww 0xb8050008 3
>> in procedure 'mww'
>>> halt
>> target state: halted
>> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>>> reset init
>> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
>> 0x0000,
>> ver: 0x0)
>> target state: halted
>> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
>>> load_image 8Muboot_RAM_version.bin 0x80000000
>> 262144 bytes written at address 0x80000000
>> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>>> resume 0x80000000
>>>
>>
>>
>>
>> ar71xx.cfg:
>> # Atheros AR71xx MIPS 24Kc SoC.
>> # tested on PB44 refererence board
>>
>> adapter_nsrst_delay 100
>> jtag_ntrst_delay 100
>>
>> reset_config trst_and_srst
>>
>> set CHIPNAME ar71xx
>>
>> jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f
>> -expected-id
>> 1
>>
>> set TARGETNAME $CHIPNAME.cpu
>> target create $TARGETNAME mips_m4k -endian big -chain-position
>> $TARGETNAME
>>
>> $TARGETNAME configure -event reset-halt-post {
>> #setup PLL to lowest common denominator 300/300/150 setting
>> mww 0xb8050000 0x40140180 ;# reset val + CPU:3 DDR:3 AHB:0
>> mww 0xb8050000 0xc0140180 ;# send to PLL
>>
>> #next command will reset for PLL changes to take effect
>> mww 0xb8050008 3 ;# set reset_switch and clock_switch
>> (resets SoC)
>> }
>>
>> $TARGETNAME configure -event reset-init {
>> #complete pll initialization
>> mww 0xb8050000 0x800f0080 ;# set sw_update bit
>> mww 0xb8050008 0 ;# clear reset_switch bit
>> mww 0xb8050000 0x800f00e8 ;# clr pwrdwn & bypass
>> mww 0xb8050008 1 ;# set clock_switch bit
>> sleep 1 ;# wait for lock
>>
>> # Setup DDR config and flash mapping
>> mww 0xb8000000 0x77b8884e ;# DDR cfg cdl val (rst: 0x5bfc8d0)
>> mww 0xb8000004 0x812cd6a8 ;# DDR cfg2 cdl val (rst:
>> 0x80d106a8)
>> #mww 0xb8000000 0xefbc8cd0 ;# DDR cfg cdl val (rst:
>> 0x5bfc8d0)
>> #mww 0xb8000004 0x8e7156a2 ;# DDR cfg2 cdl val (rst:
>> 0x80d106a8)
>>
>> mww 0xb8000010 8 ;# force precharge all banks
>> mww 0xb8000010 1 ;# force EMRS update cycle
>> mww 0xb800000c 0 ;# clr ext. mode register
>> mww 0xb8000010 2 ;# force auto refresh all banks
>> mww 0xb8000010 8 ;# force precharge all banks
>> #mww 0xb8000008 0x31 ;# set DDR mode value CAS=3
>> mww 0xb8000008 0x33 ;# set DDR mode value CAS=3
>> mww 0xb8000010 1 ;# force EMRS update cycle
>> #mww 0xb8000014 0x461b ;# DDR refresh value
>> #mww 0xb8000018 0xffff ;# DDR Read Data This Cycle value
>> (16bit:
>> 0xffff)
>> mww 0xb8000014 0x44a6 ;# DDR refresh value
>> mww 0xb8000018 0x00ff ;# DDR Read Data This Cycle value
>> (16bit:
>> 0xffff)
>> mww 0xb800001c 0x7 ;# delay added to the DQS line
>> (normal =
>> 7)
>> mww 0xb8000020 7
>> mww 0xb8000024 7
>> mww 0xb8000028 7
>> }
>>
>> # setup working area somewhere in RAM
>> $TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
>>
>> # serial SPI capable flash
>> # flash bank <driver> <base> <size> <chip_width> <bus_width>
>>
>>
>>
>> ________________________________________
>> From: Luka Perkov [luka at openwrt.org]
>> Sent: Thursday, November 29, 2012 01:21
>> To: Dmytro
>> Cc: Drassal, Allan; U-Boot Mailing List
>> Subject: Re: [U-Boot] U-Boot for MIPS AR7161
>>
>> Hi Dmytro,
>>
>> On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote:
>>> But if all you have decided to go to the end, or you need a JTAG
>>> fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform),
>>> so you can make the example of his version of the loader for AR71xx
>>> (AP96 platform).
>>
>> Please show us your patch.
>>
>> Luka
> _______________________________________________
> U-Boot mailing list
> U-Boot at lists.denx.de
> http://lists.denx.de/mailman/listinfo/u-boot
>
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-12-02 5:30 ` Dmytro
@ 2012-12-02 10:20 ` Drassal, Allan
2012-12-02 19:15 ` Daniel Schwierzeck
2012-12-02 19:21 ` Wolfgang Denk
0 siblings, 2 replies; 16+ messages in thread
From: Drassal, Allan @ 2012-12-02 10:20 UTC (permalink / raw)
To: u-boot
Sorry I need to shorten the message, exchange keeps trying to do something and I keep getting a message rejected due to "No base64 encoded MIME text parts allowed"
U-Boot list keeps rejecting the message.
U-Boot list driving me nuts... keeps rejecting my message due to the "No base64 encoded MIME text parts allowed" error, but there are none!!
Please see the full message at http://www.eecs.wsu.edu/~adrassal/reply_2012-12-02.txt
And if someone can explain this strange error message... please!
Oh, you are wonderful! This actually loads up correctly! Thanks a lot!!!
I am going to paste the output here so you can see.
However, it seems to be missing support for flinfo and for cp.b (the command I use to recopy the flash.
It detects the FLASH as 8MB, where in reality it is 32MB (or 2 16MB units)
If possible, can these be added in?
And, of course, I would like to know how you accomplished this, I would be more intested in learning how to build U-Boot for this platform, and hopefully I can get a fully functional U-Boot built later.
If it is difficult, at least now I can load something into ram (such as the kernel and original FS!) and execute them from there!
The output has been cut from this message and saved to http://www.eecs.wsu.edu/~adrassal/reply_2012-12-02.txt
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-12-02 10:20 ` Drassal, Allan
@ 2012-12-02 19:15 ` Daniel Schwierzeck
2012-12-02 19:21 ` Wolfgang Denk
1 sibling, 0 replies; 16+ messages in thread
From: Daniel Schwierzeck @ 2012-12-02 19:15 UTC (permalink / raw)
To: u-boot
Hi Allan,
2012/12/2 Drassal, Allan <drasal@wsu.edu>
> Sorry I need to shorten the message, exchange keeps trying to do something
> and I keep getting a message rejected due to "No base64 encoded MIME text
> parts allowed"
> U-Boot list keeps rejecting the message.
>
> U-Boot list driving me nuts... keeps rejecting my message due to the "No
> base64 encoded MIME text parts allowed" error, but there are none!!
> Please see the full message at
> http://www.eecs.wsu.edu/~adrassal/reply_2012-12-02.txt
>
> And if someone can explain this strange error message... please!
>
only send UTF-8 encoded text mails
>
> Oh, you are wonderful! This actually loads up correctly! Thanks a lot!!!
> I am going to paste the output here so you can see.
> However, it seems to be missing support for flinfo and for cp.b (the
> command I use to recopy the flash.
> It detects the FLASH as 8MB, where in reality it is 32MB (or 2 16MB units)
>
>
do you know that OpenWRT has a minimal U-Boot for AR71xx [1]. Though it
supports only some Zyxel board
you have at least some basic drivers for UART, Ethernet, SPI on AR71xx. But
it has no low-level init
support so you can boot it only from RAM.
> If possible, can these be added in?
> And, of course, I would like to know how you accomplished this, I would be
> more intested in learning how to build U-Boot for this platform, and
> hopefully I can get a fully functional U-Boot built later.
>
> I suggest that you try to build at first a RAM boot U-Boot based on
mainline U-Boot for your board with [1] as reference
source. For a fully working U-Boot you need deeper knowledge about how
initialization of clocks, PLL and RAM
works on the AR71xx. The easiest way to get that is to have access to
either sources from an Atheros BSP U-Boot
or a SoC manual. Do you have that?
[1]
http://git.mirror.nanl.de/?p=openwrt/trunk.git;a=tree;f=package/boot/uboot-ar71xx;h=fdf321392fd39a116da6d277fa03403814492ca5;hb=HEAD
--
Best regards,
Daniel
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-12-02 10:20 ` Drassal, Allan
2012-12-02 19:15 ` Daniel Schwierzeck
@ 2012-12-02 19:21 ` Wolfgang Denk
2012-12-03 9:28 ` Dmytro
1 sibling, 1 reply; 16+ messages in thread
From: Wolfgang Denk @ 2012-12-02 19:21 UTC (permalink / raw)
To: u-boot
Dear "Drassal, Allan",
In message <872E3B9A58411441878DD99BE03D7CF510D4280F@EXMB-02.ad.wsu.edu> you wrote:
> Sorry I need to shorten the message, exchange keeps trying to do something and I keep getting a message rejected due to "No base64 encoded MIME text parts allowed"
> U-Boot list keeps rejecting the message.
This has nothing to do with message _size_.
> U-Boot list driving me nuts... keeps rejecting my message due to the "No base64 encoded MIME text parts allowed" error, but there are none!!
> Please see the full message at http://www.eecs.wsu.edu/~adrassal/reply_2012-12-02.txt
This may be what you intended to send, but it is not what was actually
transmitted by your combination of MUA / MTA.
> And if someone can explain this strange error message... please!
The error message is supposed to be self-explaining. We do not allo
MIME multi-part messages where one or more parts are base64 encoded
MIME text parts.
Fix your mailer to send plain text only. No HTML, no base64 encoded
text parts. That's all.
Best regards,
Wolfgang Denk
--
DENX Software Engineering GmbH, MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
"There is nothing new under the sun, but there are lots of old things
we don't know yet." - Ambrose Bierce
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-12-02 19:21 ` Wolfgang Denk
@ 2012-12-03 9:28 ` Dmytro
2012-12-03 9:53 ` Drassal, Allan
0 siblings, 1 reply; 16+ messages in thread
From: Dmytro @ 2012-12-03 9:28 UTC (permalink / raw)
To: u-boot
Greetings
In general that's the last variant
http://dioptimizer.narod.ru/files/ap96/u-boot.bin (160 Kb)
It is advisable to flash original bootloader, and only then something
is seriously flash on the router.
If something does not work, see the file:
ap96/boot/u-boot/include/configs/ap96.h
(here the main SETUP platform)
How to compile the source code:
1. Extract the archive to the rights
2. Go to the folder ./build
3. Run "make BOARD_TYPE=ap96 uboot"
After build, compiled variants of uoot's will be in:
./ap96/boot/u-boot/ (elf, bin, srec, etc. format)
and
./images/ap96/ (only bin format)
http://www.mediafire.com/?5rljo2y95dypd8z (109 Mb)
P.S.
Notify, wakes it work "flinfo" for the second bank of flash memory.
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
2012-12-03 9:28 ` Dmytro
@ 2012-12-03 9:53 ` Drassal, Allan
0 siblings, 0 replies; 16+ messages in thread
From: Drassal, Allan @ 2012-12-03 9:53 UTC (permalink / raw)
To: u-boot
Dear Dmytro,
Thank you, with this I was able to rewrite the flash!
I now have been able to restore the original boot loader, and I still have interest in developing a bootloader that has additional features, however, with this I believe I can recover the device back to its original configuraration.
Thank you for the source for this, I will attempt to resolve the remaining issues.
When I have resolved them, I would be happy to share the results.
Allan
________________________________________
From: Dmytro [dioptimizer at gmail.com]
Sent: Monday, December 03, 2012 01:28
To: Drassal, Allan
Cc: U-Boot Mailing List
Subject: Re: [U-Boot] U-Boot for MIPS AR7161
Greetings
In general that's the last variant
http://dioptimizer.narod.ru/files/ap96/u-boot.bin (160 Kb)
It is advisable to flash original bootloader, and only then something
is seriously flash on the router.
If something does not work, see the file:
ap96/boot/u-boot/include/configs/ap96.h
(here the main SETUP platform)
How to compile the source code:
1. Extract the archive to the rights
2. Go to the folder ./build
3. Run "make BOARD_TYPE=ap96 uboot"
After build, compiled variants of uoot's will be in:
./ap96/boot/u-boot/ (elf, bin, srec, etc. format)
and
./images/ap96/ (only bin format)
http://www.mediafire.com/?5rljo2y95dypd8z (109 Mb)
P.S.
Notify, wakes it work "flinfo" for the second bank of flash memory.
^ permalink raw reply [flat|nested] 16+ messages in thread
* [U-Boot] U-Boot for MIPS AR7161
@ 2014-08-30 13:53 Pasquale Riccio
0 siblings, 0 replies; 16+ messages in thread
From: Pasquale Riccio @ 2014-08-30 13:53 UTC (permalink / raw)
To: u-boot
Was a u-boot created for the wzr-hp-g300nh? And if so was there a way to
flash it via jtag?
I recently wiped the bootloader on my router, i have access to jtag via bus
blaster and openocd, but do not know how to flash.
Please help
Thank you
http://lists.denx.de/pipermail/u-boot/2012-November/140917.html
^ permalink raw reply [flat|nested] 16+ messages in thread
end of thread, other threads:[~2014-08-30 13:53 UTC | newest]
Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-11-28 16:09 [U-Boot] U-Boot for MIPS AR7161 Dmytro
2012-11-29 9:21 ` Luka Perkov
2012-11-29 13:23 ` Drassal, Allan
2012-12-01 0:11 ` Dmytro
2012-12-01 4:14 ` Drassal, Allan
2012-12-01 6:10 ` Drassal, Allan
2012-12-02 5:30 ` Dmytro
2012-12-02 10:20 ` Drassal, Allan
2012-12-02 19:15 ` Daniel Schwierzeck
2012-12-02 19:21 ` Wolfgang Denk
2012-12-03 9:28 ` Dmytro
2012-12-03 9:53 ` Drassal, Allan
-- strict thread matches above, loose matches on Subject: below --
2014-08-30 13:53 Pasquale Riccio
2012-11-27 1:27 Drassal, Allan
2012-11-28 0:16 ` Daniel Schwierzeck
2012-11-28 13:21 ` Drassal, Allan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox