Buffalo NAS-Central Forums

EDIT: When you run flash write_bank the offset should be 0 not 0xfffc0000

I now have OpenOCD working with algorithms on the kuropro. It was r670 of OpenOCD with the patch at http://byronbradley.co.uk/jtag/openocd- ... dley.patch (Full source: http://byronbradley.co.uk/jtag/openocd- ... ley.tar.gz), using the Olimex tiny usb jtag adapter and the config file at http://byronbradley.co.uk/jtag/lsp_olimex.txt.

Get your u-boot image and http://byronbradley.co.uk/jtag/kuropro_ ... oot.script in the same directory as everything else and modify the last couple of lines of the script with the correct image file. The the commands should go along the lines of:

openocd -f lsp_olimex.txt

Then connect via telnet, you will probably have to enable dbgrq before it will halt successfully:

$ telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>reset
JTAG device found: 0x07926041 (Manufacturer: 0x020, Part: 0x7926, Version: 0x0)
Timed out waiting for halt after reset
> arm7_9 dbgrq enable
use of EmbeddedICE dbgrq instead of breakpoint for target halt enabled
> reset
JTAG device found: 0x07926041 (Manufacturer: 0x020, Part: 0x7926, Version: 0x0)
target state: halted
target halted in ARM state due to debug request, current mode: Supervisor
cpsr: 0x400000d3 pc: 0xfffc2c30
MMU: disabled, D-Cache: disabled, I-Cache: enabled
> script kuropro_post_uboot.script
0 0 1 0: 00052078
dcc downloads are enabled
236248 byte written at address 0x00000000
16 byte written at address 0x00f4c000
downloaded 236264 byte in 2.990981s
verified 236264 bytes in 2.264992s  

If it verified correctly then algorithms are working and you can flash using the working area:

> flash probe 0
flash 'cfi' found at 0xfffc0000
> flash info 0
#0: cfi at 0xfffc0000, size 0x00040000, buswidth 1, chipwidth 1
        #0: 0x00000000 (0x1000 4kB) protection state unknown
        [......]
        #63: 0x0003f000 (0x1000 4kB) protection state unknown

non-cfi flash:

mfr: 0x00bf, id:0x00d6

> flash erase_sector 0 0 63
erased sectors 0 through 63 on flash bank 0 in 8.105110s
> flash write_bank 0 u-boot.bin 0
>

If you want to verify the image was written correctly then you can run:

> verify_image u-boot.bin 0xfffc0000
verified 262144 bytes in 1.777500s
>

or dump the image back to file and use something like vbindiff to compare them:

> dump_image u-boot.dump.bin 0xfffc0000 0x40000
dumped 262144 byte in 27.148109s
>

$ vbindiff u-boot.bin u-boot.dump.bin

_________________
Byron Bradley

this is great ... I'd like to try it on my lsprov2 this weekend.

nice job!

_________________
LS1 (foonas, nfs, Tranmission & p910nd print server, Firefly for my Roku)
LS-HG500 (Lenny)
Various LS-Pros v1,v2 (unbricked w/ serial & jtag)
KuroPro, LS2 & KuroHG (foonas)
Working on davysweather.dyndns.org lately...

=> wooohooo!
wooohooo!
Unknown command 'wooohooo!' - try 'help'

same here. will try it on the weekend. i hope i get openocd working this time with this tarball.

_________________
LS1 (2.6 kernel, foonas svn1062, 750 GB, UBoot 1.2) & LS Pro (FreeLink/jtymod/GenLink, changes all the time)
Thx to all donators!

I have started work on a clean u-boot port for the kuropro and I'm no longer sure this script is correct. The time between reset and halt is long enough for the u-boot in flash to do quite a lot, including setting up the RAM. While this script doesn't stop the RAM from working, it might not work correctly on a box which has flash that is completely empty or damaged to the point where it can't even run the lowlevel initialisation.

The problem is that Marvell u-boot has some really awkward code paths and they have changed some of the u-boot core so it is not always clear which code is being executed or when. My script is correct for some device which is very similar to the kuropro but may not match exactly. If anybody wants to go through the u-boot code I have found the easiest way is with:

objdump -S u-boot | less # Souce and assembly
objdump -S u-boot | grep -v "  f[1234]" | less # Source only

This reduces the entire kuropro u-boot code to just over 83k lines. Hopefully I'll be able to test u-boot from flash in the next day or two so I'll be able to confirm whether the script is doing the correct thing or not then.

_________________
Byron Bradley

Awesome!
This is something the community will really appreciate. Thanks for your efforts.

I know what you mean ... I did not work on/tinker with much of the core stuff, but I did see how ballooned it was...

_________________
LS1 (foonas, nfs, Tranmission & p910nd print server, Firefly for my Roku)
LS-HG500 (Lenny)
Various LS-Pros v1,v2 (unbricked w/ serial & jtag)
KuroPro, LS2 & KuroHG (foonas)
Working on davysweather.dyndns.org lately...

=> wooohooo!
wooohooo!
Unknown command 'wooohooo!' - try 'help'

This script does work correctly, I applied the patch below to davygravy's u-boot sources and flashed that. This code runs at the very beginning long enough to delay execution until it can halt.

diff --git a/cpu/arm926ejs/start.S b/cpu/arm926ejs/start.S
index 0f621bf..61e0684 100755
--- a/cpu/arm926ejs/start.S
+++ b/cpu/arm926ejs/start.S
@@ -126,6 +126,10 @@ FIQ_STACK_START:
  */
 
 reset:
+   ldr     r10, =0xffff 
+_resetDelay:
+   subs    r10, r10, #1
+   bne     _resetDelay
 
    /*
     * set the cpu to SVC32 mode

_________________
Byron Bradley

Hi @all,

i have a broken MSS II and now i try to recover it. Can i use one of this JTAG-Interfaces?:

http://www.embedded-projects.net/index.php?page_id=177
http://www.embedded-projects.net/index.php?page_id=255

I have no LPT on my PC and must use a USB JTAG.

THX

I don't know these units... haven't used them.

I have used the olimex ARM-USB-TINY and it worked well for me on LSPro's and KuroPro.

http://www.olimex.com/dev/arm-usb-tiny.html

_________________
LS1 (foonas, nfs, Tranmission & p910nd print server, Firefly for my Roku)
LS-HG500 (Lenny)
Various LS-Pros v1,v2 (unbricked w/ serial & jtag)
KuroPro, LS2 & KuroHG (foonas)
Working on davysweather.dyndns.org lately...

=> wooohooo!
wooohooo!
Unknown command 'wooohooo!' - try 'help'

many thanks davy_gravy,

i have ordered the ARM-USB-TINY and hope it comes fast

Hi @all,

i try to flash my MSSII but my openocd dont work:

C:\Programme\OpenOCD\0.1.0\bin>openocd.exe -f D:\test.txt
Open On-Chip Debugger 0.1.0 (2009-01-21-21:15) Release


BUGS? Read http://svn.berlios.de/svnroot/repos/openocd/trunk/BUGS

$URL: https://kc8apf@svn.berlios.de/svnroot/repos/openocd/tags/openocd-0.1.0/src/openocd.c $
OLD SYNTAX: DEPRECATED - translating to new syntax
jtag newtap CHIP TAP -irlen 4 -ircapture 0x1 -irvalue 0xf
Example: STM32 has 2 taps, the cortexM3(len4) + boundryscan(len5)
jtag newtap stm32 cortexm3  ....., thus creating the tap: "stm32.cortexm3"
jtag newtap stm32 boundry  ....., and the tap: "stm32.boundery"
And then refer to the taps by the dotted name.
NEW COMMAND:
Runtime error, file "D:\test.txt", line 29:
    bad option "feroceon": must be one of count, create, current, names, number, or types

what can i do to fix this problem?

thx

what version are you using? from svn? rev=?

What version of linux/distro are you trying that in?

_________________
LS1 (foonas, nfs, Tranmission & p910nd print server, Firefly for my Roku)
LS-HG500 (Lenny)
Various LS-Pros v1,v2 (unbricked w/ serial & jtag)
KuroPro, LS2 & KuroHG (foonas)
Working on davysweather.dyndns.org lately...

=> wooohooo!
wooohooo!
Unknown command 'wooohooo!' - try 'help'

Hi davy_gravy,

i have tested openocd on my linux pc and now i can connect to the device but i cant hold them. I have no more ideas what i can do.

the version on the linux pc is: 1.0 from ubuntu repo and another one is the latest svn version

Hi @all,

can anyone help me? My Logs:

Open On-Chip Debugger 1.0 (2008-06-22-10:53) svn:unknown
$URL: http://svn.berlios.de/svnroot/repos/openocd/trunk/src/openocd.c $
Error:   jtag.c:1338 jtag_examine_chain(): JTAG communication failure, check connection, JTAG interface, target power etc.
Error:   jtag.c:1543 jtag_init_inner(): trying to validate configured JTAG chain anyway...
Error:   jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Error:   jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Error:   jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Error:   jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Error:   jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Error:   jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Error:   jtag.c:1552 jtag_init_inner(): Could not validate JTAG chain, exit
Info:    jtag.c:1376 jtag_examine_chain(): JTAG device found: 0x07926041 (Manufacturer: 0x020, Part: 0x7926, Version: 0x0)
Error:   embeddedice.c:191 embeddedice_build_reg_cache(): unknown EmbeddedICE version (comms ctrl: 0x00000018)
Info:    server.c:78 add_connection(): accepting 'telnet' connection from 0
Info:    jtag.c:1376 jtag_examine_chain(): JTAG device found: 0x07926041 (Manufacturer: 0x020, Part: 0x7926, Version: 0x0)
User:    target.c:435 target_process_reset(): Timed out waiting for halt after reset

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> arm7_9 dbgrq enable
use of EmbeddedICE dbgrq instead of breakpoint for target halt enabled
> reset
JTAG device found: 0x07926041 (Manufacturer: 0x020, Part: 0x7926, Version: 0x0)
Timed out waiting for halt after reset

telnet_port 4444
gdb_port 3333

interface ft2232
ft2232_layout "olimex-jtag"
ft2232_vid_pid 0x15ba 0x0004

#interface parport
#parport_port 0
#parport_cable wiggler

reset_config trst_and_srst
jtag_device 4 0x1 0xf 0xe
target feroceon little run_and_halt 0
run_and_halt_time 0 0
flash bank cfi 0xfffc0000 0x00040000 1 1 0 jedec_probe

ingo, I'm not sure at all what the problem is, though it looks like perhaps it is not halted ...

Have you tried posting to the forum that I mention in the JTAG for LSPRo Article?

_________________
LS1 (foonas, nfs, Tranmission & p910nd print server, Firefly for my Roku)
LS-HG500 (Lenny)
Various LS-Pros v1,v2 (unbricked w/ serial & jtag)
KuroPro, LS2 & KuroHG (foonas)
Working on davysweather.dyndns.org lately...

=> wooohooo!
wooohooo!
Unknown command 'wooohooo!' - try 'help'

having problems getting openocd running so I can jtag my ls-pro. I am getting the error below running openocd on XP using the config thats on the jtag guide for the ls-pro. Using olimex usb tiny.

C:\Program Files\openocd-r1606\bin>openocd-ftd2xx
Open On-Chip Debugger 0.2.0-in-development (2009-05-09-21:00) svn:1606M
BUGS? Read http://svn.berlios.de/svnroot/repos/openocd/trunk/BUGS

jtag_speed: 0
OLD SYNTAX: DEPRECATED - translating to new syntax
jtag newtap CHIP TAP -irlen 4 -ircapture 0x1 -irvalue 0xf
Example: STM32 has 2 taps, the cortexM3(len4) + boundaryscan(len5)
jtag newtap stm32 cortexm3 ....., thus creating the tap: "stm32.cortexm3"
jtag newtap stm32 boundary ....., and the tap: "stm32.boundary"
And then refer to the taps by the dotted name.
NEW COMMAND:
Runtime error, file "openocd.cfg", line 29:
bad option "feroceon": must be one of count, create, current, names, number,
or types

I am also getting the same error when running ubuntu and building from source. any idea whats wrong? .