flashing marvell feroceon 88f5181

Development Boards MicroMod
1

hello,

I have damaged the bootloader of mine wnr854t, with chip marvell feroceon 88f5181.

Now, i am using wiggler cable (buffered) a + openocd for re-flashing, the problem is that continuous to receive errors.

Where mistake?

thanks

file —> openocd.cfg

#daemon configuration

telnet_port 4444

gdb_port 3333

#interface

interface parport

parport_port 0x378

parport_cable wiggler

#parport_cable old_amt_wiggler

jtag_speed 1

#use combined on interfaces or targets that can’t set TRST/SRST separately

#reset_config trst_and_srst srst_pulls_trst

#reset_config trst_only

#reset_config trst_and_srst combined

reset_config srst_only

#jtag scan chain

#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)

jtag_device 4 0x1 0xf 0xe

jtag_nsrst_delay 1200

jtag_ntrst_delay 1200

#target configuration

daemon_startup reset

#target

target arm926ejs little run_and_halt 0 arm926ejs

run_and_halt_time 0 500

planing with flash code - work in progress

working_area 0 0x00400000 0x40000 nobackup

driver addr size chip_width bus_width options

flash bank cfi 0xff800000 0x400000 1 2 0

script —> command

root@massimo-desktop:/opt/openocd/trunk/src# telnet localhost 4444

Trying 127.0.0.1…

Connected to localhost.

Escape character is ‘^]’.

Open On-Chip Debugger

halt

requesting target halt…

flash write_binary 0 uboot.bin 0x0

failed writing file uboot.bin to flash bank 0 at offset 0x00000000

can’t work with this flash while target is running

wrote 458884 byte from file uboot.bin to flash bank 0 at offset 0x00000000 in 0s 1956us (229104.757797 kb/s)

file —> log.txt ( openocd -d3 -l log.txt -f openocd.cfg )

Debug: arm926ejs.c:703 arm926ejs_target_command(): chain_pos: 0, variant: arm926ejs

Debug: jtag.c:1407 jtag_init(): -

Debug: parport.c:400 parport_init(): requesting privileges for parallel port 0x378…

Debug: parport.c:410 parport_init(): …privileges granted

Debug: parport.c:234 parport_reset(): trst: 0, srst: 0

Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted

Debug: jtag.c:1197 jtag_reset_callback(): -

Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted

Debug: jtag.c:1197 jtag_reset_callback(): -

Debug: jtag.c:1291 jtag_examine_chain(): JTAG device found: 0x07926041 (Manufacturer: 0x020, Part: 0x7926, Version: 0x0

Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted

Debug: jtag.c:1197 jtag_reset_callback(): -

Debug: openocd.c:113 main(): jtag init complete

Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4

Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST released

Debug: jtag.c:1197 jtag_reset_callback(): -

Error: embeddedice.c:181 embeddedice_build_reg_cache(): unknown EmbeddedICE version (comms ctrl: 0x00000018)

Debug: arm7_9_common.c:707 arm7_9_assert_reset(): target->state: unknown

Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: SRST asserted

Debug: jtag.c:1197 jtag_reset_callback(): -

Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted

Debug: jtag.c:1197 jtag_reset_callback(): -

Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: SRST asserted

Debug: jtag.c:1197 jtag_reset_callback(): -

Debug: parport.c:234 parport_reset(): trst: 0, srst: 1

Debug: parport.c:234 parport_reset(): trst: 0, srst: 1

Debug: arm7_9_common.c:773 arm7_9_deassert_reset(): target->state: reset

Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: SRST released

Debug: jtag.c:1197 jtag_reset_callback(): -

Debug: parport.c:234 parport_reset(): trst: 0, srst: 0

Debug: openocd.c:117 main(): target init complete

Debug: openocd.c:121 main(): flash init complete

Debug: openocd.c:125 main(): NAND init complete

Debug: openocd.c:129 main(): pld init complete

Debug: gdb_server.c:1526 gdb_init(): gdb service for target arm926ejs at port 3333

Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 1

Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST released

Debug: jtag.c:1197 jtag_reset_callback(): -

Debug: arm7_9_common.c:929 arm7_9_halt(): target->state: running

Debug: embeddedice.c:384 embeddedice_write_reg(): 0: 0x00000002

Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4

Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4

Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4

Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4

Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4

Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4

Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4

2

omissam1972:
hello,

I have damaged the bootloader of mine wnr854t, with chip marvell feroceon 88f5181.

Now, i am using wiggler cable (buffered) a + openocd for re-flashing, the problem is that continuous to receive errors.

Hi, omissam1972

Currently, OpenOCD does not support Marvell’s CPU,

because it needs special control sequence.

3

tselei:

omissam1972:
hello,

I have damaged the bootloader of mine wnr854t, with chip marvell feroceon 88f5181.

Now, i am using wiggler cable (buffered) a + openocd for re-flashing, the problem is that continuous to receive errors.

Hi, omissam1972

Currently, OpenOCD does not support Marvell’s CPU,

because it needs special control sequence.

News update!!!

Marvell will release the modified openOCD that supports 88F5x and 88F6x.

4

hi tselei and thanks for the aid,

I have update openocd to the 217,

but I do not succeed to stop the marvell 88f5181, in fact:

root@massimo-desktop:~# telnet 127.0.0.1 4444

Trying 127.0.0.1…

Connected to 127.0.0.1.

Escape character is ‘^]’.

Open On-Chip Debugger

poll

target state: running

halt

requesting target halt…

poll

target state: running

load_image uboot.bin 0xff800000 bin

458884 byte written at address 0xff800000

downloaded 458884 byte in 0s 1978us

qhile the log in the openocd:

root@massimo-desktop:/opt/openocd/trunk/src# openocd -f openocd.cfg

Info: openocd.c:93 main(): Open On-Chip Debugger (2007-09-05 09:00 CEST)

Error: embeddedice.c:181 embeddedice_build_reg_cache(): unknown EmbeddedICE version (comms ctrl: 0x00000018)

Info: server.c:67 add_connection(): accepted ‘telnet’ connection from 0

Warning: arm7_9_common.c:1937 arm7_9_write_memory(): target not halted

the file openocd.cfg:

#daemon configuration

telnet_port 4444

gdb_port 3333

#interface

interface parport

parport_port 0x378

parport_cable wiggler

#parport_cable old_amt_wiggler

jtag_speed 1

#use combined on interfaces or targets that can’t set TRST/SRST separately

#reset_config trst_and_srst srst_pulls_trst

#reset_config trst_only

#reset_config trst_and_srst combined

reset_config srst_only

#jtag scan chain

#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)

jtag_device 4 0x1 0xf 0xe

jtag_nsrst_delay 1200

jtag_ntrst_delay 1200

#target configuration

daemon_startup reset

#target

target arm926ejs little run_and_halt 0 arm926ejs

run_and_halt_time 0 500

planing with flash code - work in progress

working_area 0 0x00400000 0x40000 nobackup

driver addr size chip_width bus_width options

flash bank cfi 0xff800000 0x400000 1 2 0

It is possible to stop the chip marvell?

tanks

5

where mistake? why I do not succeed in flash memory?

arm7_9 force_hw_bkpts enable

force hardware breakpoints enabled

poll

target state: running

reset

poll

target state: running

halt

requesting target halt…

poll

target state: running

Target 0 halted

target halted in Thumb state due to debug request, current mode: System

cpsr: 0xffffffff pc: 0xffffffed

MMU: enabled, D-Cache: enabled, I-Cache: enabled

> flash write_binary 0 uboot.bin 0xff800000
failed writing file uboot.bin to flash bank 0 at offset 0xff800000
destination is out of flash bank (offset and/or file too large)
wrote 458884 byte from file uboot.bin to flash bank 0 at offset 0xff800000 in 0s 2045us (219133.939487 kb/s)
> flash write_image uboot.bin
didn’t write section at 0x00000000, size 0x00070084
wrote 0 byte from file uboot.bin in 0s 189us (0.000000 kb/s)
> flash write_image uboot.bin 0xff800000
failed writing image uboot.bin: unknown error: -907
wrote 0 byte from file uboot.bin in 0s 2051us (0.000000 kb/s)

6

Try to get more info about how the flash is configured in OpenOCD with:

flash info 0

also try

flash poll 0

/Magnus

7

mlu:
Try to get more info about how the flash is configured in OpenOCD with:

flash info 0

also try

flash poll 0

/Magnus

hi mlu and thank,

this is the output of the command:

> flash info 0

#0: cfi at 0xff800000, size 0x00400000, buswidth 2, chipwidth 1

cfi flash bank not probed yet

flash poll 0

Command poll not found

I would want to restore u-boot on damaged mine router

http://www.mirto.info/documenti/wnr854t.jpg

8

Sorry for that, it should be

flash probe 0

/Magnus

9

mlu:
Sorry for that, it should be

flash probe 0

/Magnus

root@massimo-desktop:~# telnet 127.0.0.1 4444

Trying 127.0.0.1…

Connected to 127.0.0.1.

Escape character is ‘^]’.

Open On-Chip Debugger

flash probe 0

probing failed for flash bank ‘#0’ at 0xff800000

flash info 0

#0: cfi at 0xff800000, size 0x00400000, buswidth 2, chipwidth 1

cfi information:

mfr: 0x0000, id:0x0000

qry: ‘—’, pri_id: 0x0000, pri_addr: 0x0000, alt_id: 0x0000, alt_addr: 0x0000

Vcc min: 0.0, Vcc max: 0.0, Vpp min: 0.0, Vpp max: 0.0

typ. word write timeout: 1, typ. buf write timeout: 1, typ. block erase timeout: 1, typ. chip erase timeout: 1

max. word write timeout: 1, max. buf write timeout: 1, max. block erase timeout: 1, max. chip erase timeout: 1

size: 0x1, interface desc: 0, max buffer write size: 0

10

So OpenOCD cannot find any cfi flash at that address ( of course all other flash operations will fail if probing does not work )

cfi 0xff800000 0x400000 1 2 0

Do you know that this is the correct flash configuration: type, address, buswidth, chipwidth?

/Magnus

11

mlu:
So OpenOCD cannot find any cfi flash at that address ( of course all other flash operations will fail if probing does not work )

cfi 0xff800000 0x400000 1 2 0

Do you know that this is the correct flash configuration: type, address, buswidth, chipwidth?

/Magnus

I do not know, from what I have understood the flash is JS28F640 (like from figure).

When uboot and linux they worked I obtained this following log:

| | | | | __ ) ___ ___ | |_

| | | |___| _ \ / _ \ / _ | __|

| || || |) | () | () | |

_/ |____/ _/ ___/ __| ** LOADER **

** MARVELL BOARD: RD-88F5181L-VOIP-GE LE

U-Boot 1.1.1 (Mar 29 2006 - 03:28:49) Marvell version: 1.7.3

DRAM CS[0] base 0x00000000 size 32MB

DRAM Total size 32MB

[8192kB@ff800000] Flash: 8 MB

Addresses 20M - 0M are saved for the U-Boot usage.

Mem malloc Initialization (20M - 16M): Done

Soc: 88F5181 B1

CPU: ARM926 (Rev 0) running @ 500Mhz

SysClock = 166Mhz , TClock = 166Mhz

USB 0: host mode

PCI 0: PCI Express Root Complex Interface

PCI 1: Conventional PCI, speed = 33000000

Net: egiga0 [PRIME]

Hit any key to stop autoboot: 0

Marvell>>

kernel linux:

Starting kernel …

Uncompressing Linux…

. done, booting the kernel.

ZLinux version 2.4.27-vrs1 (joshua@localhost.localdomain) (gcc version 3.4.4 (re

lease) (CodeSourcery ARM 2005q3-1)) #20 Mon Dec 11 13:19:42 CST 2006

CPU: ARM926EJ-Sid(wb) revision 0

Machine: MV-88fxx81

Using UBoot passing parameters structure

Sys Clk = 166000000, Tclk = 166000000

…

…

…

PPP generic driver version 2.4.2

physmap flash device: 1000000 at f4000000

cfi_cmdset_0001: Erase suspend on write enabled

Using buffer write method

Using physmap partition definition

Creating 6 MTD partitions on “phys_mapped_flash”:

0x00000000-0x00600000 : “root”

0x00600000-0x00620000 : “nvram”

0x00620000-0x00640000 : “nvram default”

0x00640000-0x00660000 : “POT”

0x00660000-0x00680000 : “Traffic Meter”

0x00700000-0x00800000 : “uboot”

Initializing Cryptographic API

12

I do not know if it is useful.

In of the old ones log, how much it worked uboot,

I have found:

Marvell>> flinfo

Bank # 1: INTEL 28F640J3A (64 Mbit)

Size: 8 MB,Bus Width: 2, device Width: 2.

Flash base: 0xff800000,Number of Sectors: 64 Type: REGULAR.

Sector Start Addresses:

00000000 00020000 00040000 00060000 00080000

000a0000 000c0000 000e0000 00100000 00120000

00140000 00160000 00180000 001a0000 001c0000

001e0000 00200000 00220000 00240000 00260000

00280000 002a0000 002c0000 002e0000 00300000

00320000 00340000 00360000 00380000 003a0000

003c0000 003e0000 00400000 00420000 00440000

00460000 00480000 004a0000 004c0000 004e0000

00500000 00520000 00540000 00560000 00580000

005a0000 005c0000 005e0000 00600000 00620000

00640000 00660000 00680000 006a0000 006c0000

006e0000 00700000 00720000 00740000 00760000 (RO)

00780000 (RO) 007a0000 (RO) 007c0000 (RO) 007e0000 (RO)

Bank # 2: missing or unknown FLASH type

Marvell>>

13

So from the logs it seems that both the flash and the bus is set to 16 bits:

Size: 8 MB,Bus Width: 2, device Width: 2.

That would correspond to a flash configuration line:

cfi 0xff800000 0x800000 2 2 0

/Magnus

14

I have modified openocd.cfg, "cfi 0xff800000 0x800000 2 2 0 ", obtaining:

flash probe 0

probing failed for flash bank ‘#0’ at 0xff800000

flash info 0

#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 2

cfi information:

mfr: 0x0000, id:0x0000

qry: ’

halt

requesting target halt…

Target 0 halted

target halted in Thumb state due to debug request, current mode: System

cpsr: 0xffffffff pc: 0xffffffed

MMU: enabled, D-Cache: enabled, I-Cache: enabled

flash info 0

#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 2

cfi information:

mfr: 0x0000, id:0x0000

qry: ’

flash probe 0

probing failed for flash bank ‘#0’ at 0xff800000

while with “cfi 0xff800000 0x800000 1 2 0”, obtaining:

flash info 0

#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 1

cfi flash bank not probed yet

flash probe 0

probing failed for flash bank ‘#0’ at 0xff800000

flash info 0

#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 1

cfi information:

mfr: 0x0000, id:0x0000

qry: ‘888’, pri_id: 0x0000, pri_addr: 0x0000, alt_id: 0x0000, alt_addr: 0x0000

Vcc min: 0.0, Vcc max: 0.0, Vpp min: 0.0, Vpp max: 0.0

typ. word write timeout: 1, typ. buf write timeout: 1, typ. block erase timeout: 1, typ. chip erase timeout: 1

max. word write timeout: 1, max. buf write timeout: 1, max. block erase timeout: 1, max. chip erase timeout: 1

size: 0x1, interface desc: 0, max buffer write size: 0

my openocd is version 226.

15

Task that the problem is in tightens of initialization of the flash. In fact, in sources of uboot for mine router I have found these data:

file mvFlashCom.h

/* Vendor Ids */

#define INTEL_MANUF 0x89 /* INTEL manuf. ID in D23…D16, D7…D0 */

#define INTEL_ALT_MANUF 0xB0 /* alternate INTEL namufacturer ID */

file mvIntelFlash.h

/* Intel Flash IDs */

#define INTEL_FID_28F640J3A 0x0017 /* 64M = 128K x 64 */

file mvFlash.c

FLASH_STRUCT supFlashAry=

{

/* flashVen , flashId , size , #sec , secType , #Frag , pFragList , HWprot , HwWrBuff */

{INTEL_MANUF, INTEL_FID_28F640J3A, _8M, 64, REGULAR, 0, NULL, MV_TRUE, 32 },

{INTEL_MANUF, INTEL_FID_28F128J3A, _16M, 128, REGULAR, 0, NULL, MV_TRUE, 32 },

{AMD_MANUF, AMD_FID_LV040B, _512K, 8, REGULAR, 0, NULL, MV_FALSE, 0 },

{STM_MANUF, STM_FID_29W040B, _512K, 8, REGULAR, 0, NULL, MV_FALSE, 0 },

{SST_MANUF, SST_39VF_020, _256K, 64, REGULAR, 0, NULL, MV_FALSE, 0 },

{LAST_FLASH, LAST_FLASH, 0, 0, REGULAR, 0, NULL, MV_FALSE, 0 }

};

file mvFlashCom.c

/*******************************************************************************

  • flashDataExt - Extend Data.

  • DESCRIPTION:

  • Should be used only for FLASH CFI command sequence.

  • Prepare the Data according to the Flash Width and Bus Width.

  • If flash width = 2 and bus width = 1 data = 0x55 → data = 0x55

  • If flash width = 2 and bus width = 4 data = 0x55 → data = 0x550055

  • If flash width = 1 and bus width = 4 data = 0x55 → data = 0x55555555

  • INPUT:

  • data - Data to be expended.

  • pFlash - flash information.

  • OUTPUT:

  • None

  • RETURN:

  • MV_U32 - Data after extension.

  • OxFFFFFFFF if pFlash is Null

*******************************************************************************/

16

omissam1972:
hi tselei and thanks for the aid,

I have update openocd to the 217,

but I do not succeed to stop the marvell 88f5181, in fact:

root@massimo-desktop:~# telnet 127.0.0.1 4444

Trying 127.0.0.1…

Connected to 127.0.0.1.

Escape character is ‘^]’.

Open On-Chip Debugger

poll

target state: running

halt

requesting target halt…

poll

target state: running

load_image uboot.bin 0xff800000 bin

458884 byte written at address 0xff800000

downloaded 458884 byte in 0s 1978us

qhile the log in the openocd:

root@massimo-desktop:/opt/openocd/trunk/src# openocd -f openocd.cfg

Info: openocd.c:93 main(): Open On-Chip Debugger (2007-09-05 09:00 CEST)

Error: embeddedice.c:181 embeddedice_build_reg_cache(): unknown EmbeddedICE version (comms ctrl: 0x00000018)

Info: server.c:67 add_connection(): accepted ‘telnet’ connection from 0

Warning: arm7_9_common.c:1937 arm7_9_write_memory(): target not halted

the file openocd.cfg:

#daemon configuration

telnet_port 4444

gdb_port 3333

#interface

interface parport

parport_port 0x378

parport_cable wiggler

#parport_cable old_amt_wiggler

jtag_speed 1

#use combined on interfaces or targets that can’t set TRST/SRST separately

#reset_config trst_and_srst srst_pulls_trst

#reset_config trst_only

#reset_config trst_and_srst combined

reset_config srst_only

#jtag scan chain

#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)

jtag_device 4 0x1 0xf 0xe

jtag_nsrst_delay 1200

jtag_ntrst_delay 1200

#target configuration

daemon_startup reset

#target

target arm926ejs little run_and_halt 0 arm926ejs

run_and_halt_time 0 500

planing with flash code - work in progress

working_area 0 0x00400000 0x40000 nobackup

driver addr size chip_width bus_width options

flash bank cfi 0xff800000 0x400000 1 2 0

It is possible to stop the chip marvell?

tanks

Hi,

Because the JTAG sequencry is not the same between ARM926 and 88F5x,

you need a patch to make the open OCD to stop 88F5x or you will not stop the CPU or not resume the CPU

Currently, I have a test version openOCD that works on 88F5x and 88F6x but it is not fully tested yet.

17

hi,

thanks to Nicolas Pitre for the carried out job up to now.

Now, with the new version of openocd I could restore u-boot on mine router WNR854T NETGEAR?

thanks

18

you can certainly try…

I have met with more success with my LSProV2 now… having JTAG-unbricked it perhaps 10 times or so now within the last 2-3 weeks.

For me, the version that I have had the best luck with is svn335.

I have put my notes/HOWTO here…

[JTAG and OpenOCD for the LSPro.

This is not for a router, but rather for a NAS device, but it is Feroceon based… as in 88f5182.

Your board is undoubtedly differently but maybe you can find success.

Halting continues to be the difficult part.

Good luck!](http://buffalo.nas-central.org/index.php/JTAG_%26_OpenOCD_for_LS-Pro)

19

hi, and thanks for the participation

my problem remains in making to recognize the flash. in fact:

Marvell>> flinfo

Bank # 1: INTEL 28F640J3A (64 Mbit)

Size: 8 MB,Bus Width: 2, device Width: 2.

Flash base: 0xff800000,Number of Sectors: 64 Type: REGULAR.

Sector Start Addresses: …

and my config .cfg is:

# target <reset_mode>

target feroceon little reset_init 0

flash bank <chip_width> <bus_width> [driver_options …]

flash bank cfi 0xff800000 0x800000 2 2 0 jedec_probe

answer of openocd:

halt

target was already halted

poll

target state: halted

target halted in Thumb state due to debug request, current mode: System

cpsr: 0xffffffff pc: 0xffffffe3

MMU: disabled, D-Cache: disabled, I-Cache: disabled

flash banks

#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 2

flash probe 0

value captured during scan didn’t pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f

in_handler reported a failed check

… … … …

JTAG error while reading cpsr

probing failed for flash bank ‘#0’ at 0xff800000

where it is the error?

20

omissam, it does appear to be correctly halted. That looks good.

did you try a reset also? then a halt? I also have found that I frequently need to restart my USB-JTAG device by unplugging it, and also power down the target device completely. I see you are using a wiggler/paraport device, so you might have to restart your computer - not sure, though (I haven’t flashed w/ a paraport device and am not familiar w/ them…).

are you sure your flash bank line in your config file is correct?

-are there really two banks there?

-the address 0xff800000 looks correct from the uboot-log that you posted…

  • is the size of 8MB correct ? 0x800000 ?

Also, I use ```
target feroceon little reset_init 0


I am not able to get "working area" to function ... so I have that turned off...

My current config is posted in the article : [http://buffalo.nas-central.org/index.ph ... ng_OpenOCD](http://buffalo.nas-central.org/index.php/JTAG_%26_OpenOCD_for_LS-Pro#Getting.2C_Compiling_and_Configuring_OpenOCD)

good luck to you

davy

EDIT: I have found a difference in behavior between when serial and ethernet are connected to the board vs. when *only* JTAG is connected... it seems to behave better sometimes when only JTAG is connected...