Page 1 of 2

flashing marvell feroceon 88f5181

Posted: Fri Nov 16, 2007 12:37 pm
by omissam1972
hello,
I have damaged the bootloader of mine wnr854t, with chip marvell feroceon 88f5181.
Now, i am using wiggler cable (buffered) a + openocd for re-flashing, the problem is that continuous to receive errors.

Where mistake?

thanks

file ---> openocd.cfg
#daemon configuration
telnet_port 4444
gdb_port 3333

#interface
interface parport
parport_port 0x378
parport_cable wiggler
#parport_cable old_amt_wiggler
jtag_speed 1
#use combined on interfaces or targets that can't set TRST/SRST separately
#reset_config trst_and_srst srst_pulls_trst
#reset_config trst_only
#reset_config trst_and_srst combined
reset_config srst_only

#jtag scan chain
#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)
jtag_device 4 0x1 0xf 0xe

jtag_nsrst_delay 1200
jtag_ntrst_delay 1200

#target configuration
daemon_startup reset

#target <type> <endianness> <startup mode> <chainpos> <variant>
target arm926ejs little run_and_halt 0 arm926ejs
run_and_halt_time 0 500

# planing with flash code - work in progress
working_area 0 0x00400000 0x40000 nobackup

# driver addr size chip_width bus_width options
flash bank cfi 0xff800000 0x400000 1 2 0
script ---> command
root@massimo-desktop:/opt/openocd/trunk/src# telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> halt
requesting target halt...
> flash write_binary 0 uboot.bin 0x0
failed writing file uboot.bin to flash bank 0 at offset 0x00000000
can't work with this flash while target is running
wrote 458884 byte from file uboot.bin to flash bank 0 at offset 0x00000000 in 0s 1956us (229104.757797 kb/s)
>

file ---> log.txt ( openocd -d3 -l log.txt -f openocd.cfg )
Debug: arm926ejs.c:703 arm926ejs_target_command(): chain_pos: 0, variant: arm926ejs
Debug: jtag.c:1407 jtag_init(): -
Debug: parport.c:400 parport_init(): requesting privileges for parallel port 0x378...
Debug: parport.c:410 parport_init(): ...privileges granted
Debug: parport.c:234 parport_reset(): trst: 0, srst: 0
Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted
Debug: jtag.c:1197 jtag_reset_callback(): -
Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted
Debug: jtag.c:1197 jtag_reset_callback(): -
Debug: jtag.c:1291 jtag_examine_chain(): JTAG device found: 0x07926041 (Manufacturer: 0x020, Part: 0x7926, Version: 0x0
Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted
Debug: jtag.c:1197 jtag_reset_callback(): -
Debug: openocd.c:113 main(): jtag init complete
Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST released
Debug: jtag.c:1197 jtag_reset_callback(): -
Error: embeddedice.c:181 embeddedice_build_reg_cache(): unknown EmbeddedICE version (comms ctrl: 0x00000018)
Debug: arm7_9_common.c:707 arm7_9_assert_reset(): target->state: unknown
Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: SRST asserted
Debug: jtag.c:1197 jtag_reset_callback(): -
Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted
Debug: jtag.c:1197 jtag_reset_callback(): -
Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: SRST asserted
Debug: jtag.c:1197 jtag_reset_callback(): -
Debug: parport.c:234 parport_reset(): trst: 0, srst: 1
Debug: parport.c:234 parport_reset(): trst: 0, srst: 1
Debug: arm7_9_common.c:773 arm7_9_deassert_reset(): target->state: reset
Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: SRST released
Debug: jtag.c:1197 jtag_reset_callback(): -
Debug: parport.c:234 parport_reset(): trst: 0, srst: 0
Debug: openocd.c:117 main(): target init complete
Debug: openocd.c:121 main(): flash init complete
Debug: openocd.c:125 main(): NAND init complete
Debug: openocd.c:129 main(): pld init complete
Debug: gdb_server.c:1526 gdb_init(): gdb service for target arm926ejs at port 3333
Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 1
Debug: jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST released
Debug: jtag.c:1197 jtag_reset_callback(): -
Debug: arm7_9_common.c:929 arm7_9_halt(): target->state: running
Debug: embeddedice.c:384 embeddedice_write_reg(): 0: 0x00000002
Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug: embeddedice.c:220 embeddedice_read_reg_w_check(): 4

Re: flashing marvell feroceon 88f5181

Posted: Tue Nov 27, 2007 2:55 am
by tselei
omissam1972 wrote:hello,
I have damaged the bootloader of mine wnr854t, with chip marvell feroceon 88f5181.
Now, i am using wiggler cable (buffered) a + openocd for re-flashing, the problem is that continuous to receive errors.

Hi, omissam1972
Currently, OpenOCD does not support Marvell's CPU,
because it needs special control sequence.

Re: flashing marvell feroceon 88f5181

Posted: Wed Nov 28, 2007 8:50 pm
by tselei
tselei wrote:
omissam1972 wrote:hello,
I have damaged the bootloader of mine wnr854t, with chip marvell feroceon 88f5181.
Now, i am using wiggler cable (buffered) a + openocd for re-flashing, the problem is that continuous to receive errors.

Hi, omissam1972
Currently, OpenOCD does not support Marvell's CPU,
because it needs special control sequence.

News update!!!

Marvell will release the modified openOCD that supports 88F5x and 88F6x.

Posted: Sat Dec 08, 2007 12:22 am
by omissam1972
hi tselei and thanks for the aid,

I have update openocd to the 217,
but I do not succeed to stop the marvell 88f5181, in fact:
root@massimo-desktop:~# telnet 127.0.0.1 4444
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Open On-Chip Debugger
> poll
target state: running
> halt
requesting target halt...
> poll
target state: running
> load_image uboot.bin 0xff800000 bin
458884 byte written at address 0xff800000
downloaded 458884 byte in 0s 1978us
>
qhile the log in the openocd:
root@massimo-desktop:/opt/openocd/trunk/src# openocd -f openocd.cfg
Info: openocd.c:93 main(): Open On-Chip Debugger (2007-09-05 09:00 CEST)
Error: embeddedice.c:181 embeddedice_build_reg_cache(): unknown EmbeddedICE version (comms ctrl: 0x00000018)
Info: server.c:67 add_connection(): accepted 'telnet' connection from 0
Warning: arm7_9_common.c:1937 arm7_9_write_memory(): target not halted
the file openocd.cfg:
#daemon configuration
telnet_port 4444
gdb_port 3333

#interface
interface parport
parport_port 0x378
parport_cable wiggler
#parport_cable old_amt_wiggler
jtag_speed 1
#use combined on interfaces or targets that can't set TRST/SRST separately
#reset_config trst_and_srst srst_pulls_trst
#reset_config trst_only
#reset_config trst_and_srst combined
reset_config srst_only

#jtag scan chain
#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)
jtag_device 4 0x1 0xf 0xe

jtag_nsrst_delay 1200
jtag_ntrst_delay 1200

#target configuration
daemon_startup reset

#target <type> <endianness> <startup mode> <chainpos> <variant>
target arm926ejs little run_and_halt 0 arm926ejs
run_and_halt_time 0 500

# planing with flash code - work in progress
working_area 0 0x00400000 0x40000 nobackup

# driver addr size chip_width bus_width options
flash bank cfi 0xff800000 0x400000 1 2 0
It is possible to stop the chip marvell?

tanks

Posted: Sat Dec 08, 2007 12:56 am
by omissam1972
where mistake? why I do not succeed in flash memory?
> arm7_9 force_hw_bkpts enable
force hardware breakpoints enabled
> poll
target state: running
> reset
> poll
target state: running
> halt
requesting target halt...
> poll
target state: running
> Target 0 halted
target halted in Thumb state due to debug request, current mode: System
cpsr: 0xffffffff pc: 0xffffffed
MMU: enabled, D-Cache: enabled, I-Cache: enabled

> flash write_binary 0 uboot.bin 0xff800000
failed writing file uboot.bin to flash bank 0 at offset 0xff800000
destination is out of flash bank (offset and/or file too large)
wrote 458884 byte from file uboot.bin to flash bank 0 at offset 0xff800000 in 0s 2045us (219133.939487 kb/s)

> flash write_image uboot.bin
didn't write section at 0x00000000, size 0x00070084
wrote 0 byte from file uboot.bin in 0s 189us (0.000000 kb/s)

> flash write_image uboot.bin 0xff800000
failed writing image uboot.bin: unknown error: -907
wrote 0 byte from file uboot.bin in 0s 2051us (0.000000 kb/s)


Posted: Sun Dec 09, 2007 7:09 am
by mlu
Try to get more info about how the flash is configured in OpenOCD with:

> flash info 0

also try

> flash poll 0

/Magnus

Posted: Sun Dec 09, 2007 9:42 am
by omissam1972
mlu wrote:Try to get more info about how the flash is configured in OpenOCD with:

> flash info 0

also try

> flash poll 0

/Magnus
hi mlu and thank,

this is the output of the command:
> flash info 0
#0: cfi at 0xff800000, size 0x00400000, buswidth 2, chipwidth 1

cfi flash bank not probed yet

> flash poll 0
Command poll not found


I would want to restore u-boot on damaged mine router
Image

Posted: Sun Dec 09, 2007 10:58 am
by mlu
Sorry for that, it should be

> flash probe 0

/Magnus

Posted: Sun Dec 09, 2007 2:53 pm
by omissam1972
mlu wrote:Sorry for that, it should be

> flash probe 0
/Magnus
root@massimo-desktop:~# telnet 127.0.0.1 4444
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Open On-Chip Debugger
> flash probe 0
probing failed for flash bank '#0' at 0xff800000
> flash info 0
#0: cfi at 0xff800000, size 0x00400000, buswidth 2, chipwidth 1

cfi information:

mfr: 0x0000, id:0x0000
qry: '---', pri_id: 0x0000, pri_addr: 0x0000, alt_id: 0x0000, alt_addr: 0x0000
Vcc min: 0.0, Vcc max: 0.0, Vpp min: 0.0, Vpp max: 0.0
typ. word write timeout: 1, typ. buf write timeout: 1, typ. block erase timeout: 1, typ. chip erase timeout: 1
max. word write timeout: 1, max. buf write timeout: 1, max. block erase timeout: 1, max. chip erase timeout: 1
size: 0x1, interface desc: 0, max buffer write size: 0

>

Posted: Sun Dec 09, 2007 3:21 pm
by mlu
So OpenOCD cannot find any cfi flash at that address ( of course all other flash operations will fail if probing does not work )

cfi 0xff800000 0x400000 1 2 0

Do you know that this is the correct flash configuration: type, address, buswidth, chipwidth?

/Magnus

Posted: Mon Dec 10, 2007 4:51 am
by omissam1972
mlu wrote:So OpenOCD cannot find any cfi flash at that address ( of course all other flash operations will fail if probing does not work )

cfi 0xff800000 0x400000 1 2 0

Do you know that this is the correct flash configuration: type, address, buswidth, chipwidth?

/Magnus
I do not know, from what I have understood the flash is JS28F640 (like from figure).
When uboot and linux they worked I obtained this following log:

| | | | | __ ) ___ ___ | |_
| | | |___| _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
\___/ |____/ \___/ \___/ \__| ** LOADER **
** MARVELL BOARD: RD-88F5181L-VOIP-GE LE

U-Boot 1.1.1 (Mar 29 2006 - 03:28:49) Marvell version: 1.7.3

DRAM CS[0] base 0x00000000 size 32MB
DRAM Total size 32MB
[8192kB@ff800000] Flash: 8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done

Soc: 88F5181 B1
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz


USB 0: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net: egiga0 [PRIME]
Hit any key to stop autoboot: 0
Marvell>>


kernel linux:

Starting kernel ...

Uncompressing Linux.............................................................
. done, booting the kernel.
ZLinux version 2.4.27-vrs1 (joshua@localhost.localdomain) (gcc version 3.4.4 (re
lease) (CodeSourcery ARM 2005q3-1)) #20 Mon Dec 11 13:19:42 CST 2006
CPU: ARM926EJ-Sid(wb) revision 0
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 166000000, Tclk = 166000000
...
...
...
PPP generic driver version 2.4.2
physmap flash device: 1000000 at f4000000
cfi_cmdset_0001: Erase suspend on write enabled
Using buffer write method
Using physmap partition definition
Creating 6 MTD partitions on "phys_mapped_flash":
0x00000000-0x00600000 : "root"
0x00600000-0x00620000 : "nvram"
0x00620000-0x00640000 : "nvram default"
0x00640000-0x00660000 : "POT"
0x00660000-0x00680000 : "Traffic Meter"
0x00700000-0x00800000 : "uboot"
Initializing Cryptographic API

Posted: Mon Dec 10, 2007 1:10 pm
by omissam1972
I do not know if it is useful.
In of the old ones log, how much it worked uboot,
I have found:

Marvell>> flinfo

Bank # 1: INTEL 28F640J3A (64 Mbit)
Size: 8 MB,Bus Width: 2, device Width: 2.
Flash base: 0xff800000,Number of Sectors: 64 Type: REGULAR.
Sector Start Addresses:
00000000 00020000 00040000 00060000 00080000
000a0000 000c0000 000e0000 00100000 00120000
00140000 00160000 00180000 001a0000 001c0000
001e0000 00200000 00220000 00240000 00260000
00280000 002a0000 002c0000 002e0000 00300000
00320000 00340000 00360000 00380000 003a0000
003c0000 003e0000 00400000 00420000 00440000
00460000 00480000 004a0000 004c0000 004e0000
00500000 00520000 00540000 00560000 00580000
005a0000 005c0000 005e0000 00600000 00620000
00640000 00660000 00680000 006a0000 006c0000
006e0000 00700000 00720000 00740000 00760000 (RO)
00780000 (RO) 007a0000 (RO) 007c0000 (RO) 007e0000 (RO)

Bank # 2: missing or unknown FLASH type
Marvell>>

Posted: Mon Dec 10, 2007 2:16 pm
by mlu
So from the logs it seems that both the flash and the bus is set to 16 bits:
Size: 8 MB,Bus Width: 2, device Width: 2.
That would correspond to a flash configuration line:

cfi 0xff800000 0x800000 2 2 0

/Magnus

Posted: Tue Dec 11, 2007 1:58 am
by omissam1972
I have modified openocd.cfg, "cfi 0xff800000 0x800000 2 2 0 ", obtaining:


> flash probe 0
probing failed for flash bank '#0' at 0xff800000
> flash info 0
#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 2

cfi information:

mfr: 0x0000, id:0x0000
qry: '
> halt
requesting target halt...
> Target 0 halted
target halted in Thumb state due to debug request, current mode: System
cpsr: 0xffffffff pc: 0xffffffed
MMU: enabled, D-Cache: enabled, I-Cache: enabled
> flash info 0
#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 2

cfi information:

mfr: 0x0000, id:0x0000
qry: '
> flash probe 0
probing failed for flash bank '#0' at 0xff800000
>


while with "cfi 0xff800000 0x800000 1 2 0", obtaining:

> flash info 0
#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 1

cfi flash bank not probed yet

> flash probe 0
probing failed for flash bank '#0' at 0xff800000
> flash info 0
#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 1

cfi information:

mfr: 0x0000, id:0x0000
qry: '888', pri_id: 0x0000, pri_addr: 0x0000, alt_id: 0x0000, alt_addr: 0x0000
Vcc min: 0.0, Vcc max: 0.0, Vpp min: 0.0, Vpp max: 0.0
typ. word write timeout: 1, typ. buf write timeout: 1, typ. block erase timeout: 1, typ. chip erase timeout: 1
max. word write timeout: 1, max. buf write timeout: 1, max. block erase timeout: 1, max. chip erase timeout: 1
size: 0x1, interface desc: 0, max buffer write size: 0


my openocd is version 226.

Posted: Tue Dec 11, 2007 1:48 pm
by omissam1972
Task that the problem is in tightens of initialization of the flash. In fact, in sources of uboot for mine router I have found these data:

file mvFlashCom.h
/* Vendor Ids */
#define INTEL_MANUF 0x89 /* INTEL manuf. ID in D23..D16, D7..D0 */
#define INTEL_ALT_MANUF 0xB0 /* alternate INTEL namufacturer ID */

file mvIntelFlash.h
/* Intel Flash IDs */
#define INTEL_FID_28F640J3A 0x0017 /* 64M = 128K x 64 */

file mvFlash.c
FLASH_STRUCT supFlashAry[]=
{
/* flashVen , flashId , size , #sec , secType , #Frag , pFragList , HWprot , HwWrBuff */

{INTEL_MANUF, INTEL_FID_28F640J3A, _8M, 64, REGULAR, 0, NULL, MV_TRUE, 32 },
{INTEL_MANUF, INTEL_FID_28F128J3A, _16M, 128, REGULAR, 0, NULL, MV_TRUE, 32 },
{AMD_MANUF, AMD_FID_LV040B, _512K, 8, REGULAR, 0, NULL, MV_FALSE, 0 },
{STM_MANUF, STM_FID_29W040B, _512K, 8, REGULAR, 0, NULL, MV_FALSE, 0 },
{SST_MANUF, SST_39VF_020, _256K, 64, REGULAR, 0, NULL, MV_FALSE, 0 },
{LAST_FLASH, LAST_FLASH, 0, 0, REGULAR, 0, NULL, MV_FALSE, 0 }
};


file mvFlashCom.c
/*******************************************************************************
* flashDataExt - Extend Data.
* DESCRIPTION:
* Should be used only for FLASH CFI command sequence.
*
* Prepare the Data according to the Flash Width and Bus Width.
* If flash width = 2 and bus width = 1 data = 0x55 -> data = 0x55
* If flash width = 2 and bus width = 4 data = 0x55 -> data = 0x550055
* If flash width = 1 and bus width = 4 data = 0x55 -> data = 0x55555555
*
* INPUT:
* data - Data to be expended.
* pFlash - flash information.
*
* OUTPUT:
* None
*
* RETURN:
* MV_U32 - Data after extension.
* OxFFFFFFFF if pFlash is Null
*
*******************************************************************************/