[U-Boot] U-Boot for MIPS AR7161

Dmytro dioptimizer at gmail.com
Sat Dec 1 01:11:25 CET 2012


Hi Allan Drassal,

Frankly, I'm not in practice faced ar71xx processors in labs, but I
can give details on experience with the ar724x CPUs.

First we need to determine are fully is support in ar71xx.cfg file for
your device.
You need connect to the JTAG and switch the device in halt mode. Next
read the following registers using OpenOCD:
mdw 0xb8000000 0x10
mdw 0xb8050000
mdw 0xb8050008
mdw 0xb805000c

On the second device with a working firmware, do the same thing, only
in u-boot (it's as though after the initialization of the CPU):
md 0xb8000000 0x10
md 0xb8050000 0x1
md 0xb8050008 0x1
md 0xb805000c 0x1

What is it for?
Before initializing the processor - PLL records are in resetting state
These values are described in the files ar71xx.cfg or ar724x.cfg in
parentheses. Then based on these (reset) values are any operation
with PLL. I.e. We do not just give to known command to processor - We
read from the processor value and produce a binary operation on it
according to the rules described in the source lowlevel_init (if you
take the PLL). The same thing with the any initialization process.

Need will explain how to work with ar71xx.cfg configuration file.
Event "reset-halt-post" thegas telnet command "reset halt"
but this command directly related to the physical nSRST. I.e. During
the execution of commands "reset halt" - nSRTS goes to logic "1" at
the same time, this processor receives commands switch to "halt". In
my experience on ar724x CPUs - is no longer used nSRTS and has been
replaced on RST so "reset halt" does not work in my case and the
difficulty I had was that it was necessary to make sure that the
processor is switched to the correct mode, and it was settings needed
register (make sure you can read the "mdw 0xb8050000 "after the event
is triggered and you will once again transferred CPU in halt mode.).
As a last resort you can do "ar71xx.cpu invoke-event
reset-halt-post "(if not work "reset halt" as it should) for example
in the instructions:
http://www.google.com/translate_c?langpair=ru|en&u=http://wiki.openwrt.org/ru/toh/tp-link/tl-mr3420/debrick%2525using%2525jtag

The next step will be a check memory:
You need to load the image in the memory at 0xa0010000
load_image iamge.bin 0xa0010000
(Address window of DRAM memory at the platform AP96, PB42, etc. - 0xa0010000)
and most importantly, it immediately check and compare with the
original in HEX mode
mdw 0xa0010000 0x10
mdw 0xa0010000 0x10
(check 2 times)
This is due to the fact that If the specified is not correct timings
for the memory then the first read memory may even be quite normal,
but when we re-reading data, the data may already be offset (and
eventually, the data starts, as if to float). Usually corrects this
problem by selecting values in the less side DQS0, DQS1 line.

Bootloader 8Muboot_RAM_version.bin course is not suitable for your
purpose, you need to compile the bootloader for your platform and your
address space (0xa0010000). So far the only thing I can say about it -
I'm trying to solve this problem and will soon let you know the
results.

P.S.
As variants, there are plenty of opportunities to find the right boot
for your processor, for example there is a recovery function for
COMPEX devices:
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/How% 20to% 20JTAG% 20to%
20Compex% 20Loader.pdf
(Instruction)
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/upbios.tst
(needed file for flash via tftp (without UART))
https://dev.openwrt.org/attachment/ticket/8393/init-ar7130-32m.mac
(config for OCD Commande - can easily be changed to OpenOCD)
http://www.cpx.cz/dls/JTAG% 20SW_CONFIG_INSTR/wp543.rar
(bootloader for ar7130)
http://www.cpx.cz/dls/wpe72_WPE72NX_MMJ5N26E/wp72_loader_jtag.zip
(as bonus this for ar724x - not tested with me)

Regards, Dmytro

2012/11/29, Drassal, Allan <drasal at wsu.edu>:
> Dear Dmytro and others,
>
> Sorry, I didn't post the output in the previous post, just the commands.
> I am going to post the full output below, along with the details of the
> ar71xx.cfg file, and output from openocd also.
> The config file originally came from an AR724x processor as well, so it
> might not be correct for an AR71xx.
> I would appreciate assistance in identifying the mistakes and correcting
> them if you don't mind please.
> Please share with myself and others if you can.
>
> The code that I am attempting to run in the processor, again for the AR724x,
> is 8Muboot_RAM_version.bin
> It can be found easily on the internet with a google search.  If you have
> the expertise to identify what can be changed to make this compatile with
> the AR71xx, please do.
> This code partially runs because upon execution, it turns on an LED on the
> board.  However, it gives no UART output that I can see.
>
> I am still interested in porting U-Boot to this processor as well, and I
> have found bits and pieces of previous work done, but nothing that I can
> identify as compelte.
> MIPS does not seem to be in the main line for U-Boot, but I might be
> mistaken, correct me if I am wrong here.
> My experience is limited with MIPS archetecture, but I would be willing to
> assist in a port, and testing on the hardware that I have.
>
> Thanks,
> Allan Drassal
>
>
> output from openocd, (./bin/openocd -f interface/sheevaplug.cfg -f
> ar71xx.cfg):
> Open On-Chip Debugger 0.6.1 (2012-11-23-20:49)
> Licensed under GNU GPL v2
> For bug reports, read
> 	http://openocd.sourceforge.net/doc/doxygen/bugs.html
> Info : only one transport option; autoselect 'jtag'
> adapter speed: 1000 kHz
> adapter_nsrst_delay: 100
> jtag_ntrst_delay: 100
> trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
> 131072
> Info : clock speed 1000 kHz
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> Info : accepting 'telnet' connection from 4444
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> Warn : target not halted
> in procedure 'mww'
> Warn : target not halted
> in procedure 'mww'
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> in procedure 'mww'
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
> Info : JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part:
> 0x0000, ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
> 262144 bytes written at address 0x80000000
> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>
>
> output from the telnet session (telnet 127.0.0.1 4444):
> Trying 127.0.0.1...
> Connected to 127.0.0.1.
> Escape character is '^]'.
> Open On-Chip Debugger
>> reset
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> reset
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
>> mww 0xb8060008 3
> target not halted
> in procedure 'mww'
>> mww 0xb806000c 0x12c
> target not halted
> in procedure 'mww'
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> mww 0xb8050000 0x00090828
>> mww 0xb8050000 0x00050828
>> mww 0xb8050000 0x00040828
>> mww 0xb8050008 2
>> mww 0xb8050008 3
> in procedure 'mww'
>> halt
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00380
>> reset init
> JTAG tap: ar71xx.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000,
> ver: 0x0)
> target state: halted
> target halted in MIPS32 mode due to debug-request, pc: 0xbfc00000
>> load_image 8Muboot_RAM_version.bin 0x80000000
> 262144 bytes written at address 0x80000000
> downloaded 262144 bytes in 4.165334s (61.460 KiB/s)
>> resume 0x80000000
>>
>
>
>
> ar71xx.cfg:
> # Atheros AR71xx MIPS 24Kc SoC.
> # tested on PB44 refererence board
>
> adapter_nsrst_delay 100
> jtag_ntrst_delay 100
>
> reset_config trst_and_srst
>
> set CHIPNAME ar71xx
>
> jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id
> 1
>
> set TARGETNAME $CHIPNAME.cpu
> target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME
>
> $TARGETNAME configure -event reset-halt-post {
> 	#setup PLL to lowest common denominator 300/300/150 setting
> 	mww 0xb8050000 0x40140180	;# reset val + CPU:3 DDR:3 AHB:0
> 	mww 0xb8050000 0xc0140180	;# send to PLL
>
> 	#next command will reset for PLL changes to take effect
> 	mww 0xb8050008 3		;# set reset_switch and clock_switch (resets SoC)
> }
>
> $TARGETNAME configure -event reset-init {
> 	#complete pll initialization
> 	mww 0xb8050000 0x800f0080	;# set sw_update bit
> 	mww 0xb8050008 0		;# clear reset_switch bit
> 	mww 0xb8050000 0x800f00e8       ;# clr pwrdwn & bypass
> 	mww 0xb8050008 1		;# set clock_switch bit
> 	sleep 1                         ;# wait for lock
>
> 	# Setup DDR config and flash mapping
> 	mww 0xb8000000 0x77b8884e       ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> 	mww 0xb8000004 0x812cd6a8       ;# DDR cfg2 cdl val (rst: 0x80d106a8)
> 	#mww 0xb8000000 0xefbc8cd0       ;# DDR cfg cdl val (rst: 0x5bfc8d0)
> 	#mww 0xb8000004 0x8e7156a2       ;# DDR cfg2 cdl val (rst: 0x80d106a8)
>
> 	mww 0xb8000010 8		;# force precharge all banks
> 	mww 0xb8000010 1 		;# force EMRS update cycle
> 	mww 0xb800000c 0                ;# clr ext. mode register
> 	mww 0xb8000010 2 		;# force auto refresh all banks
> 	mww 0xb8000010 8		;# force precharge all banks
> 	#mww 0xb8000008 0x31             ;# set DDR mode value CAS=3
> 	mww 0xb8000008 0x33             ;# set DDR mode value CAS=3
> 	mww 0xb8000010 1 		;# force EMRS update cycle
> 	#mww 0xb8000014 0x461b           ;# DDR refresh value
> 	#mww 0xb8000018 0xffff           ;# DDR Read Data This Cycle value (16bit:
> 0xffff)
> 	mww 0xb8000014 0x44a6           ;# DDR refresh value
> 	mww 0xb8000018 0x00ff           ;# DDR Read Data This Cycle value (16bit:
> 0xffff)
> 	mww 0xb800001c 0x7              ;# delay added to the DQS line (normal =
> 7)
> 	mww 0xb8000020 7
> 	mww 0xb8000024 7
> 	mww 0xb8000028 7
> }
>
> # setup working area somewhere in RAM
> $TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000
>
> # serial SPI capable flash
> # flash bank <driver> <base> <size> <chip_width> <bus_width>
>
>
>
> ________________________________________
> From: Luka Perkov [luka at openwrt.org]
> Sent: Thursday, November 29, 2012 01:21
> To: Dmytro
> Cc: Drassal, Allan; U-Boot Mailing List
> Subject: Re: [U-Boot] U-Boot for MIPS AR7161
>
> Hi Dmytro,
>
> On Wed, Nov 28, 2012 at 06:09:21PM +0200, Dmytro wrote:
>> But if all you have decided to go to the end, or you need a JTAG
>> fundamentally, I can put a patch for RAM_uboot AR724x (AP99 platform),
>> so you can make the example of his version of the loader for AR71xx
>> (AP96 platform).
>
> Please show us your patch.
>
> Luka


More information about the U-Boot mailing list