Broadcom BCM3368

Hello!

I have a question regarding MIPS support. I need to flash BCM3368 chip (or actually 8MB flash memory to connected to that chip). Flashing it with wrt54g (debrick utility for routers) takes really long time (like few days…). So I decided to give openocd a try, as it seems to have MIPS support (I have been using it for ARM targets and it worked perfect there).

But openocd fails to halt the processor and therefore refuses to read or write any memory.

My configuration file:


if { [info exists CHIPNAME] } {

set _CHIPNAME $CHIPNAME

} else {

set _CHIPNAME BC3368

}

if { [info exists ENDIAN] } {

set _ENDIAN $ENDIAN

} else {

set _ENDIAN little

}

telnet_port 4444

gdb_port 3333

interface parport

parport_port 0x378

parport_cable wiggler

jtag_nsrst_delay 100

jtag_ntrst_delay 100

reset_config srst_only

jtag scan chain

format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)

jtag newtap $_CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1 -expected-id 0x0336817F

set _TARGETNAME $_CHIPNAME.cpu

target create $_TARGETNAME mips_m4k -endian $_ENDIAN -chain-position $_TARGETNAME


Reset works (openocd resets the board) and reading the chip ID also works. After reset it reports that target has been halted etc. But trying to read the memory informs that target is running… and halt does not work. Could someone five me some hints how to proceed?

my openocd version is the latest I got from the “git” and compiled it under cygwin with parallel port support.

BR, Madis

mips support is working ok for m4k but not as tested on other mips cores.

can you provide a full debug log, as without it i have no way of helping.

Cheers

spen

Hello!

I generated small debug output and added configuration file telnet commands I entered.

Thank you for your reply,

Madis

soft_reset_halt is not implemented for the mips core, it is not required. Reminds me to update the code :slight_smile:

try changing the following cfg line

jtag newtap $_CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 0x0336817F

can you also try a reset halt instead?

also try a reset halt with reset_config srst_only commented out.

Cheers

Spen

Hello!

I tried to modify the config file (no rst config) and reset halt instead of soft_reset_halt. But no difference really.

In case reset line is enabled (not commented out), openocd manages to physically reset the chip and figures out that the state is “halted”. But polling still shows that target is running. And memory read/write does not work then. I included the log files.

I have been playing with wrt debrick utility also (attached the source). Added reset line management, new flash type etc. This sofware manages to halt (at least it thinks so:-) ) the processor and write the flash (up to 25% in some reason) and DMA forced off (dont know why). But the flash writing is extreamly slow. Thats why I have big hope on openocd.

Thank you for your reply!

BR, Madis

looking better but still not quite right.

can you try the latest openocd straight from the git repo?

you can either use git for this or just download a snapshot:

http://openocd.git.sourceforge.net/git/ … ter;sf=tgz

There has been some changes with regards to the reset handling since the v0.4 release.

Cheers

Spen

Hello!

I compiled the new version of openocd under cygwin (latest):

git clone git://openocd.git.sourceforge.net/gitroot/openocd/openocd

./bootstrap

./configure --enable-maintainer-mode --disable-werror --disable-shared --enable-parport --enable-parport_giveio

make

make install

Now I have new problem, sorry. My configuration file does not seem to fit anymore. Openocd complains about command “jtag” not known anymore… Could you please check the log and conf file. Probably I miss something…

Thanks, Madis

add the following after the interface cmd, eg.

interface parport

interface_transports “jtag”

and also

adapter_nsrst_delay 100

jtag_ntrst_delay 100

Cheers

Spen

Hello!

Thanks for the directions. Version 050 now works too. But it works the same as 040, no improvement in “halt” unfortunately. I included the log files…

BR, Madis

Is this the same with reset_config srst_only enabled?

To be honest i am running out of ideas, the mips support has worked on the cores i have tried and may need work with others.

The mips core is being halted but then it seems to leave debug mode - very strange.

Without hardware to test success is not looking good.

Cheers

Spen

I seem to be having similar issues with the Broadcom 4712. I am currently using my bus pirate to connect, but had similar results with a parport/DCL5 interface. I’m new to JTAG, so can someone give me a sanity check on my config?

Thanks.

telnet_port 3333
gdb_port 4444

interface buspirate
buspirate_port /dev/ttyUSB0
buspirate_speed normal # or fast
buspirate_vreg 0
buspirate_mode normal
buspirate_pullup 0

#reset_config srst_only

if { [info exists CHIPNAME] } {
   set  _CHIPNAME $CHIPNAME
} else {
   set  _CHIPNAME bcm4712
}
if { [info exists ENDIAN] } {
   set  _ENDIAN $ENDIAN
} else {
   set  _ENDIAN little
}
if { [info exists CPUTAPID ] } {
   set _CPUTAPID $CPUTAPID
} else {
   # force an error till we get a good number
   set _CPUTAPID 0x1471217f
}

adapter_nsrst_delay 100
jtag_ntrst_delay 100
jtag newtap $_CHIPNAME cpu -irlen 8 -ircapture 0x1 -irmask 0xff -expected-id $_CPUTAPID
set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME mips_m4k -endian $_ENDIAN -chain-position $_TARGETNAME

Open On-Chip Debugger

poll

background polling: on

TAP: bcm4712.cpu (enabled)

target state: running

halt

target state: halted

target halted in MIPS32 mode due to debug-request, pc: 0x00000000

poll

background polling: on

TAP: bcm4712.cpu (enabled)

target state: running

reset halt

JTAG tap: bcm4712.cpu tap/device found: 0x1471217f (mfg: 0x0bf, part: 0x4712, ver: 0x1)

Halt timed out, wake up GDB.

timed out while waiting for target halted

TARGET: bcm4712.cpu - Not halted

Command handler execution failed

in procedure ‘reset’

poll

background polling: on

TAP: bcm4712.cpu (enabled)

target state: running

soft_reset_halt

requesting target halt and executing a soft reset

poll

background polling: on

TAP: bcm4712.cpu (enabled)

target state: running