OpenWrt Forum Archive

Topic: RECOVERY WNR854T with Jtag or serial port? help, solution

The content of this topic has been archived on 26 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

after 7 times that the router made reboot, I have thought about passing to the version 1.4.09 of the firmware, MA the sfiga...
error upgrate firmware, led power light fixed amber, led lan_1 light fixed amber (but receiving you date).

does a solution exist? software of restoration example Jtag or serial port (into wnr854t)?

please help me??

JTAG:
1 Vcc
2 nTRST
3 Ground
4 TDI
5 Ground
6 TMS
7 TDO
8 TCK
9 sRST
10 RTCK

Serial:
1 Tx
2 Vcc
3 NC
4 Vcc
5 NC
6 Ground
7 Rx
8 Ground
9 NC

OpenOCD works for JTAG, but may not be required.

thanks in advance, 
 
getting off WNR854T I have seen the pins 10 holes (JTAG) and pins 9 holes (Serial Port). 
could you give me some indication on the footsteps to follow now? me the only thing that currently me posseggos are WNR854T + firmware wnr854t_1_4_23_non_na_only.img.   
Do Jtag exist for this processor economic ARM ARM926EJ-S? 
 
thanks dgi, for the help

(Last edited by omissam1972 on 3 Nov 2007, 14:19)

The processor is a Marvell Feroceon 88F5181, and not a true ARM926EJ-S. If you want to use JTAG, you need to buy or make a JTAG adapter, but DO NOT get/make an unbuffered one, like the "WRT54G De-Brick Cable" described everywhere. I use a Wiggler-type. If you want to use serial, you need a device or circuit for serial communications that operates ONLY at 3.3V:
http://wiki.openwrt.org/OpenWrtDocs/Cus … JTAG_Cable
http://wiki.openwrt.org/OpenWrtDocs/Cus … al_Console
http://wiki.openwrt.org/OpenWrtDocs/Har … ear/WNR854

hi dgi,   
   
since I have do I find a MAX232 to house, do I think about looking for of U-boot to transfer the bootloader that is found in the rising WNR854T_v1.4.23_GPL.tgzes, and subsequently through TFTP (lan) OpenWrt to transfer the kernel? 
   
is it possible to do this, would you lend me a hand? how do I move me? thanks


5-Jan-2006


U-Boot Release notes , release: 1.7.3



--------------------------------------------------------------------------------



Table of Contents
1.    Contents of Release
2.    Supported boards
3.    U-Boot Board detection process in U-Boot
4.    U-Boot supported Board ID format
5.    How to build U-Boot
6.    U-Boot compilation flags used in this release
7.    Changes from Previous Releases
8.    Known Issues
9.    Disclaimer



--------------------------------------------------------------------------------

1. Contents of Release (n)
Included in current release (n):

- U-Boot source code patch version 1.7.3

- U-Boot binaries for


Board Name
Image name   
--------------------------------- --------------------------
------------------------------------------------------------
DB-88F5181-DDR1
DB-88F5181-DDR2
DB-88F5X81-DDR2-A
DB-88F5X81-DDR1-A

Big Endian Binary - u-boot_DB_5x81_BE.bin
Big Endian S-Record - u-boot_DB_5x81_BE.srec
Big Endian ELF - u-boot_DB_5x81_BE.elf

Little Endian Binary - u-boot_DB_5x81_LE.bin
Little Endian S-Record -u-boot_DB_5x81_LE.srec
Little Endian ELF -u-boot_DB_5x81_LE.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
RD-88F5181-88SX7042-2XSATA

Little Endian binary - u-boot_RD-5181_88SX7042_2xSATA.bin
Little Endian S-Record - u-boot_RD-5181_88SX7042_2xSATA.srec
Little Endian ELF - u-boot_RD-5181_88SX7042_2xSATA.elf

--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
RD-88F5181-VOIP-RD1

Little Endian binary - u-boot_RD_5181_VOIP.bin
Little Endian S-Record - u-boot_RD_5181_VOIP.srec
Little Endian ELF - u-boot_RD_5181_VOIP.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
DB-88F5182-DDR2

Big Endian Binary - u-boot_DB_5182_BE.bin
Big Endian S-Record - u-boot_DB_5182_BE.srec
Big Endian ELF - u-boot_DB_5182_BE.elf

Little Endian Binary - u-boot_DB_5182_LE.bin
Little Endian S-Record -u-boot_DB_5182_LE.srec
Little Endian ELF -u-boot_DB_5182_LE.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
RD-88F5182-NAS-2

Little Endian Binary - u-boot_RD_5182_LE.bin
Little Endian S-Record -u-boot_RD_5182_LE.srec
Little Endian ELF -u-boot_RD_5182_LE.elf

--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
DB-88F5181-DDR1-PRPMC

Little Endian Binary - u-boot_DB_5181_PRPMC.bin
Little Endian S-Record -u-boot_DB_5181_PRPMC.srec
Little Endian ELF -u-boot_DB_5181_PRPMC.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
DB-88F5181-DDR1-PEXPCI

Little Endian Binary - u-boot_DB_5181_PEX_PCI.bin
Little Endian S-Record -u-boot_DB_5181_PEX_PCI.srec
Little Endian ELF -u-boot_DB_5181_PEX_PCI.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
RD-88F5181L-VOIP-FE

Little Endian Binary -u-boot_RD_5181L_FE.bin
Little Endian S-Record-u-boot_RD_5181L_FE.srec
Little Endian ELF-u-boot_RD_5181L_FE.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
RD-88F5181L-VOIP-FE (with 88F5181 SOC)

Little Endian Binary -u-boot_RD_5181_FE.bin
Little Endian S-Record-u-boot_RD_5181_FE.srec
Little Endian ELF-u-boot_RD_5181_FE.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
RD-88F5181L-VOIP-GE

Little Endian Binary -u-boot_RD_5181L_GE.bin
Little Endian S-Record-u-boot_RD_5181L_GE.srec
Little Endian ELF-u-boot_RD_5181L_GE.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------
DB-88F5181L-DDR2-2xTDM

Big Endian Binary - u-boot_DB_5181L_2xTDM_BE.bin
Big Endian S-Record - u-boot_DB_5181L_2xTDM_BE.srec
Big Endian ELF - u-boot_DB_5181L_2xTDM_BE.elf

Little Endian Binary - u-boot_DB_5181L_2xTDM_LE.bin
Little Endian S-Record -u-boot_DB_5181L_2xTDM_LE.srec
Little Endian ELF -u-boot_DB_5181L_2xTDM_LE.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------

(Last edited by omissam1972 on 4 Nov 2007, 09:14)

ciao, 
 
according to you the bootloader u-boot will be ruined?   
if him, from what I have understood reading OpenWrt-->3.Building Netgear firmware I should make upload of the following fileses: 
--------------------------------- --------------------------
------------------------------------------------------------
DB-88F5181-DDR1
DB-88F5181-DDR2
DB-88F5X81-DDR2-A
DB-88F5X81-DDR1-A
------------------------------------------------------------
Little Endian Binary - u-boot_DB_5x81_LE.bin
Little Endian S-Record -u-boot_DB_5x81_LE.srec
Little Endian ELF -u-boot_DB_5x81_LE.elf
--------------------------------- --------------------------
------------------------------------------------------------
------------------------------------------------------------ 
 
Can I follow the procedure here described http://wiki.emqbit.com/flashing-the-ecb-at91? This for the elegant bin, and for the other formats as debbo tresferirli (srec, elf)? 
 
please, help me!

Try using a serial console first. If that works, you do not need to make any changes to the bootloader, and you will be able to use commands at the serial console to make the device grab the firmware image from the network. If the serial console does not work, *then* you would use JTAG to replace the bootloader. When you attach a serial console adapter, do not power the adapter from the device, because it will not have enough power. Use an additional external 3.3V regulated supply.

ciao dgi,

perfect U-Boot works!! 

__  __                      _ _-delete-chain               
         
        |  \/  | __ _ _ ____   _____| | |d chain                                 
        | |\/| |/ _` | '__\ \ / / _ \ | |hain target                           
 
        | |  | | (_| | |   \ V /  __/ | |y on chain to target                     
        |_|  |_|\__,_|_|    \_/ \___|_|_|
  --rename-chain               
     
_   _     ____              _                             
| | | |   | __ )  ___   ___ | |_ Change chain name, (moving any
| | | |___|  _ \ / _ \ / _ \| __|                                 
| |_| |___| |_) | (_) |ns:       
         
DRAM CS[0] base 0x00000000   size  32MB[!] address[/mask]                     
DRAM Total size  32MB                     
[8192kB@ff800000] Flash:  8 MB                             
Addresses 20M - 0M are saved for the U-Boot usage. input name[+]                                   
Mem malloc Initialization (20M - 16M): Doneterface name ([+] for wildcard)           

Soc: 88F5181 B1               
CPU: ARM926 (Rev 0) running @ 500Mhzp        -j target                 
SysClock = 166Mhz , TClock = 166Mhz    target for rule (may load targe


USB 0: host mode               
PCI 0: PCI Express Root Complex Interface         
  --match       -m match     
PCI 1: Conventional PCI, spee                           
Marvell>>

now as continuous to transfer the image?

still WNR854T,

who drives me in the good result?  is output of flinfo correct in the bank 2?
 
What I have succeeded in getting till now is:

Marvell>> tftpboot 00000000 file_image.img
Filename 'file_image.img'.
Load address: 0x0
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###########################################################
done
Bytes transferred = 6291476 (600014 hex)
Marvell>>
Marvell>> bootm 00000000
## Booting image at 00000000 ...
Bad Magic Number

Marvell>>
Marvell>> flinfo

Bank # 1: INTEL 28F640J3A (64 Mbit)
Size:  8 MB,Bus Width: 2, device Width: 2.
Flash base: 0xff800000,Number of Sectors: 64 Type: REGULAR.
  Sector Start Addresses:
    00000000      00020000      00040000      00060000      00080000
    000a0000      000c0000      000e0000      00100000      00120000
    00140000      00160000      00180000      001a0000      001c0000
    001e0000      00200000      00220000      00240000      00260000
    00280000      002a0000      002c0000      002e0000      00300000
    00320000      00340000      00360000      00380000      003a0000
    003c0000      003e0000      00400000      00420000      00440000
    00460000      00480000      004a0000      004c0000      004e0000
    00500000      00520000      00540000      00560000      00580000
    005a0000      005c0000      005e0000      00600000      00620000
    00640000      00660000      00680000      006a0000      006c0000
    006e0000      00700000      00720000      00740000      00760000 (RO)
    00780000 (RO) 007a0000 (RO) 007c0000 (RO) 007e0000 (RO)

Bank # 2: missing or unknown FLASH type
Marvell>>

(Last edited by omissam1972 on 6 Nov 2007, 19:29)

please, can nobody help me?

i'm currently buying wnr854t and planing to use kamikaze.i dont understand the mtd partition and how to flash kamikaze at what address to

hi,
we see if I have improved the condition begins them!!

answer of openocd:
> halt
target was already halted
> poll
target state: halted
target halted in Thumb state due to debug request, current mode: System
cpsr: 0xffffffff pc: 0xffffffe3
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> flash banks
#0: cfi at 0xff800000, size 0x00800000, buswidth 2, chipwidth 2
> flash probe 0
value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f
in_handler reported a failed check
... ... ... ...
JTAG error while reading cpsr
probing failed for flash bank '#0' at 0xff800000

I have found in the portale netgear sources of firmware with u-boot enclosed.
From the reading of files (README) from you indicated to me, I have gained the following parts:

./u-boot_88fxx81-1_7_3/include/configs/db88f5181.h

/*
 * (C) Copyright 2003
 * Texas Instruments.
 * Kshitij Gupta <kshitij@ti.com>
 * Configuation settings for the TI OMAP Innovator board.
 *
 * (C) Copyright 2004
 * ARM Ltd.
 * Philippe Robin, <philippe.robin@arm.com>
 * Configuration for Integrator AP board.
 *.
 * See file CREDITS for list of people who contributed to this
 * project.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 of
 * the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.    See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
 * MA 02111-1307 USA
 */

#ifndef __CONFIG_H
#define __CONFIG_H

#ifndef  MV_88F5181
#define MV_88F5181
#endif
#include "/board/mv88fxx81/mvSysHwConfig.h"
/************/
/* VERSIONS */
/************/
#define CONFIG_IDENT_STRING   " Marvell version: 1.7.3"

/* version number passing when loading Kernel */
#define VER_NUM 0x01070300           /* 1.7.3 */

/********************/
/* MV DEV SUPPORTS  */
/********************/   
#define CONFIG_PCI           /* pci support               */
#undef CONFIG_PCI_1         /* sec pci interface support */

/**********************************/
/* Marvell Monitor Extension      */
/**********************************/
#define enaMonExt()( /*(!getenv("enaMonExt")) ||\*/\
           ( getenv("enaMonExt") && \
                       ((!strcmp(getenv("enaMonExt"),"yes")) ||\
             (!strcmp(getenv("enaMonExt"),"Yes"))) \
           )\
          )

/********/
/* CLKs */
/********/
#ifndef __ASSEMBLY__
extern unsigned int mvSysClkGet(void);
extern unsigned int mvTclkGet(void);
extern unsigned int mvCntmrClkFreqGet(unsigned int);
#define UBOOT_CNTR      0      /* counter to use for uboot timer */

#define CFG_HZ         mvCntmrClkFreqGet(UBOOT_CNTR)      
#define CFG_TCLK                mvTclkGet()
#define CFG_BUS_HZ              mvSysClkGet()
#define CFG_BUS_CLK             CFG_BUS_HZ
#endif

/********************/
/* Dink PT settings */
/********************/
#define CFG_MV_PT

#ifdef CFG_MV_PT
#define CFG_PT_BASE  (CFG_MALLOC_BASE - 0x80000)
#endif /* #ifdef CFG_MV_PT */


/*************************************/
/* High Level Configuration Options  */
/* (easy to change)           */
/*************************************/
#define CONFIG_MARVELL      1
#define CONFIG_DB88FXX81    1
#define CONFIG_DB88F5181   1   /* this is an DB88F1181   board*/
#define CONFIG_ARM926EJS   1      /* CPU */


/* commands */

#define CONFIG_BOOTP_MASK   (CONFIG_BOOTP_DEFAULT | \
             CONFIG_BOOTP_BOOTFILESIZE)

#ifdef MV_USB
#define CONFIG_COMMANDS   ((CONFIG_CMD_DFL \
          | CFG_CMD_I2C \
          | CFG_CMD_EEPROM \
          | CFG_CMD_PCI \
          | CFG_CMD_NET \
          | CFG_CMD_PING \
          | CFG_CMD_DATE \
          | CFG_CMD_BSP ) & ~CFG_CMD_CACHE & ~CFG_CMD_EXT2)
#else
#define CONFIG_COMMANDS ((CONFIG_CMD_DFL \
                   | CFG_CMD_DHCP   \
                   | CFG_CMD_ELF   \
                         | CFG_CMD_I2C \
                         | CFG_CMD_EEPROM \
                         | CFG_CMD_PCI \
                         | CFG_CMD_NET \
                         | CFG_CMD_PING \
                         | CFG_CMD_JFFS2 \
                         | CFG_CMD_DATE \
          | CFG_CMD_IDE | CFG_CMD_EXT2 \
                         | CFG_CMD_BSP ) & ~CFG_CMD_CACHE   \
                              & ~CFG_CMD_BDI    \
                              & ~CFG_CMD_LOADB    \
                              & ~CFG_CMD_LOADS   \
                              & ~CFG_CMD_IMI   \
                              & ~CFG_CMD_NFS   \
                              & ~CFG_CMD_ITEST   \
                              & ~CFG_CMD_IMLS   \
                              & ~CFG_CMD_FPGA   \
                              & ~CFG_CMD_SETGETDCR   \
                              & ~CFG_CMD_AUTOSCRIPT   \
                              & ~CFG_CMD_CONSOLE   \
                              )
                  
#endif

#ifdef MV_TINY_IMAGE
#undef CONFIG_COMMANDS
#define CONFIG_COMMANDS (CFG_CMD_PCI \
                  | CFG_CMD_FLASH   \
                   | CFG_CMD_ENV   \
                   | CFG_CMD_NET   \
                   | CFG_CMD_IDE   \
                   | CFG_CMD_EXT2   \
                   | CFG_CMD_MEMORY   \
                   | CFG_CMD_BOOTD)
#endif

/* this must be included AFTER the definition of CONFIG_COMMANDS (if any) */
#include <cmd_confdefs.h>

#define   CFG_MAXARGS   16      /* max number of command args   */

/*-----------------------------------------------------------------------
 * IDE/ATA stuff (Supports IDE harddisk on PCMCIA Adapter)
 *-----------------------------------------------------------------------
 */

#undef   CONFIG_IDE_8xx_PCCARD      /* Use IDE with PC Card   Adapter   */

#undef   CONFIG_IDE_8xx_DIRECT      /* Direct IDE    not supported   */
#undef   CONFIG_IDE_LED         /* LED   for ide not supported   */
#undef   CONFIG_IDE_RESET      /* reset for ide not supported   */

#define CFG_IDE_MAXBUS      4   /* max. 1 IDE bus      */
#define CFG_IDE_MAXDEVICE   CFG_IDE_MAXBUS * 8   /* max. 1 drive per IDE bus   */

#define CFG_ATA_IDE0_OFFSET   0x0000

#undef CONFIG_MAC_PARTITION
#define CONFIG_DOS_PARTITION
#define CONFIG_LBA48

/* which initialization functions to call for this board */
#define CONFIG_MISC_INIT_R   1      /* after relloc initialization*/
#undef CONFIG_DISPLAY_MEMMAP    /* at the end of the bootprocess show the memory map*/

#define CONFIG_ENV_OVERWRITE    /* allow to change env parameters */

#undef   CONFIG_WATCHDOG      /* watchdog disabled      */

/* Cache */
#define CFG_CACHELINE_SIZE   32   


/* global definetions. */
#define   CFG_SDRAM_BASE      0x00000000


#define CFG_RESET_ADDRESS   0xffff0000
#if defined (DB_PRPMC)
#define CFG_MALLOC_BASE      (48 << 20) /* 48M */
#else
#define CFG_MALLOC_BASE      (16 << 20) /* 16M */
#endif
/*
 * When locking data in cache you should point the CFG_INIT_RAM_ADDRESS
 * To an unused memory region. The stack will remain in cache until RAM
 * is initialized
*/
#define   CFG_MALLOC_LEN      (4 << 20)   /* (default) Reserve 4MB for malloc*/

#define CFG_GBL_DATA_SIZE   128  /* size in bytes reserved for init data */

#define CONFIG_INIT_CRITICAL      /* critical code in start.S */


/********/
/* DRAM */
/********/

#define CFG_DRAM_BANKS      4

/* this defines whether we want to use the lowest CAL or the highest CAL available,*/
/* we also check for the env parameter CASset.                 */
#define MV_MIN_CAL

#define CFG_MEMTEST_START     0x00400000
#define CFG_MEMTEST_END       0x00C00000

/********/
/* RTC  */
/********/
#if (CONFIG_COMMANDS & CFG_CMD_DATE)
#define CFG_NVRAM_SIZE  0x00 /* dummy */
#define CFG_NVRAM_BASE_ADDR DEVICE_CS1_BASE /* dummy */
#define CONFIG_RTC_DS1339
#endif /* #if (CONFIG_COMMANDS & CFG_CMD_DATE) */

/********************/
/* Serial + parser  */
/********************/
/*
 * The following defines let you select what serial you want to use
 * for your console driver.
 */

#define CONFIG_BAUDRATE         115200   /* console baudrate = 115000    */
#define CFG_BAUDRATE_TABLE   { 9600, 19200, 38400, 57600, 115200, 230400 }
 
#define CFG_DUART_IO      DEVICE_CS2_BASE
#define CFG_DUART_CHAN      0      /* channel to use for console */
#define CFG_INIT_CHAN1
#define CFG_INIT_CHAN2

#define CONFIG_LOADS_ECHO       0       /* echo off for serial download */
#define CFG_LOADS_BAUD_CHANGE           /* allow baudrate changes       */

#define CFG_CONSOLE_INFO_QUIET  /* don't print In/Out/Err console assignment. */

/* parser */
/* don't chang the parser if you want to load Linux(if you cahnge it to HUSH the cmdline will
   not pass to the kernel correctlly???) */
/*#define CFG_HUSH_PARSER */
#undef CFG_HUSH_PARSER
#define CONFIG_AUTO_COMPLETE

#define CFG_PROMPT_HUSH_PS2   "> "

#define   CFG_LONGHELP         /* undef to save memory      */
#define   CFG_PROMPT   "Marvell>> "   /* Monitor Command Prompt   */
#define   CFG_CBSIZE   256      /* Console I/O Buffer Size   */
#define   CFG_PBSIZE (CFG_CBSIZE+sizeof(CFG_PROMPT)+16) /* Print Buffer Size */

/* temp no ethernet in ferocion */
/************/
/* ETHERNET */
/************/
/* to change the default ethernet port, use this define (options: 0, 1, 2) */
#define CONFIG_NET_MULTI

#define YUK_ETHADDR             "00:00:00:EE:51:81"
#define ETHADDR             "00:00:00:00:51:81"

#define CONFIG_IPADDR      10.4.50.146

#define CONFIG_SERVERIP      10.4.50.4

/***************************************/
/* LINUX BOOT and other ENV PARAMETERS */
/***************************************/
#if defined (DB_PRPMC) || defined(RD_88F5181L_FE) || defined(RD_88F5181L_GE)

#define CFG_BOOTARGS_END ":::DB88FXX81:eth0:none"
#else
#define CFG_BOOTARGS_END ":::DB88FXX81:egiga0:none"
#endif

#define CONFIG_ZERO_BOOTDELAY_CHECK

#define   CFG_LOAD_ADDR      0x00400000   /* default load address   */

#undef   CONFIG_BOOTARGS

/* auto boot*/
#define CONFIG_BOOTDELAY   3       /* by default no autoboot */

#if (CONFIG_BOOTDELAY >= 0)
#define CONFIG_BOOTCOMMAND      "tftpboot 0x400000 $(image_name);\
 setenv bootargs $(bootargs) $(bootargs_root) nfsroot=$(serverip):$(rootpath) \
 ip=$(ipaddr):$(serverip)$(bootargs_end);  bootm 0x400000; "
                                                                                                             
#if defined(RD_88F5181L_FE) || defined(RD_88F5181L_GE)

#define CONFIG_BOOTARGS "console=ttyS0,115200 mtdparts=phys_mapped_flash:15m(root),1m@15m(uboot)ro"

#else

#define CONFIG_BOOTARGS "console=ttyS0,115200"

#endif

#define CONFIG_ROOTPATH   /mnt/ARM_FS/
#endif /* #if (CONFIG_BOOTDELAY >= 0) */

#define CFG_BARGSIZE   CFG_CBSIZE   /* Boot Argument Buffer Size   */

/*
 * For booting Linux, the board info and command line data
 * have to be in the first 8 MB of memory, since this is
 * the maximum mapped by the Linux kernel during initialization.
 */
#define   CFG_BOOTMAPSZ      (8<<20)   /* Initial Memory map for Linux */

#define BRIDGE_REG_BASE_BOOTM 0xfbe00000 /* this paramaters are used when booting the linux kernel */

#define CONFIG_CMDLINE_TAG              1       /* enable passing of ATAGs  */
#define CONFIG_SETUP_MEMORY_TAGS        1
#define CONFIG_MARVELL_TAG              1
#define ATAG_MARVELL                    0x41000403

/********/
/* I2C  */
/********/
#define CFG_I2C_EEPROM_ADDR_LEN 1
#define CFG_I2C_MULTI_EEPROMS
#define CFG_I2C_SPEED   100000      /* I2C speed default */

/* I2C addresses for the two DIMM SPD chips */
#define DIMM0_I2C_ADDR   0x56
#define DIMM1_I2C_ADDR   0x54

/* CPU I2C settings */
#define CPU_I2C 
#define I2C_CPU0_EEPROM_ADDR    0x51


/********/
/* PCI  */
/********/
#ifdef CONFIG_PCI
 #define CONFIG_PCI_HOST PCI_HOST_FORCE /* select pci host function     */
 #define CONFIG_PCI_PNP             /* do pci plug-and-play         */

/* Pnp PCI Network cards */
#if defined (DB_PRPMC)
 #define CONFIG_SK98         /* yukon */
#elif defined (MV_TINY_IMAGE)
 /* nothing meanwhile */
#else
 
 #define CONFIG_EEPRO100      /* Support for Intel 82557/82559/82559ER chips */
#ifndef MV_USB
 #define CONFIG_SK98         /* yukon */
#endif
 #define CONFIG_DRIVER_RTL8029

#endif

#endif /* #ifdef CONFIG_PCI */

#define PCI_HOST_ADAPTER 0              /* configure ar pci adapter     */
#define PCI_HOST_FORCE   1              /* configure as pci host        */
#define PCI_HOST_AUTO    2              /* detected via arbiter enable  */

/* for Yukon */
#define __mem_pci(x) x
#define __io_pci(x) x
#define __arch_getw(a)         (*(volatile unsigned short *)(a))
#define __arch_putw(v,a)      (*(volatile unsigned short *)(a) = (v))


/***********************/
/* FLASH organization  */
/***********************/
#define CFG_MAX_FLASH_BANKS   2   /* max number of memory banks   */
#define CFG_MAX_FLASH_SECT   128   /* max number of sectors on one chip */
#define CFG_FLASH_PROTECTION    1

#define CFG_EXTRA_FLASH_DEVICE   DEVICE3   /* extra flash at device 3 */
#define CFG_EXTRA_FLASH_WIDTH   4   /* 32 bit */
#define CFG_BOOT_FLASH_WIDTH   1   /* 8 bit */

#define CFG_FLASH_ERASE_TOUT   120000/1000   /* 120000 - Timeout for Flash Erase (in ms) */
#define CFG_FLASH_WRITE_TOUT   500   /* 500 - Timeout for Flash Write (in ms) */
#define CFG_FLASH_LOCK_TOUT   500   /* 500- Timeout for Flash Lock (in ms) */
#define CFG_FLASH_CFI      1

#define CFG_FLASH_BASE      BOOTDEV_CS_BASE

#if defined(RD_88F5182) && defined(MV_TINY_IMAGE)

#define   CFG_ENV_IS_IN_FLASH   1
#define   CFG_ENV_SIZE            0x1000   /* Total Size of Environment Sector */
#define CFG_ENV_SECT_SIZE         0x1000
#define CFG_ENV_ADDR             0xfffff000

#define   CFG_MONITOR_LEN            (252 << 10)   /* Reserve 252 kB for Monitor */
#define CFG_MONITOR_BASE         (CFG_FLASH_BASE)
#define CFG_MONITOR_IMAGE_OFFSET   0x0   /* offset of the monitor from the
                                 u-boot image */

#elif defined(RD_88F5181L_FE) || defined(RD_88F5181L_GE) || defined(RD_88F5182)

#define BOARD_LATE_INIT

#define   CFG_ENV_IS_IN_FLASH         1
#define   CFG_ENV_SIZE            0xA000   /* Total Size of Environment Sector */
#define CFG_ENV_SECT_SIZE         0x20000
#define CFG_ENV_ADDR             (CFG_FLASH_BASE + 0xF60000)

#define   CFG_MONITOR_LEN            (448 << 10)   /* Reserve 448 kB for Monitor */
#define CFG_MONITOR_BASE         (CFG_FLASH_BASE + 0xF90000)
#define CFG_MONITOR_IMAGE_OFFSET   0x10000   /* offset of the monitor from the
                                 u-boot image */

#else

#define   CFG_ENV_IS_IN_FLASH         1
#define   CFG_ENV_SIZE            0xA000   /* Total Size of Environment Sector */
#define CFG_ENV_SECT_SIZE         0x10000
#define CFG_ENV_ADDR             (CFG_FLASH_BASE)

#define   CFG_MONITOR_LEN            (448 << 10)   /* Reserve 448 kB for Monitor */
#define CFG_MONITOR_BASE         (CFG_FLASH_BASE + 0x10000)
#define CFG_MONITOR_IMAGE_OFFSET   0x10000 /* offset of the monitor from the
                                 u-boot image */

#endif


#if (CONFIG_COMMANDS & CFG_CMD_JFFS2)

#if defined(RD_88F5181L_FE) || defined(RD_88F5181L_GE)
 /* Flash banks JFFS2 should use */
 #define CFG_JFFS2_FIRST_BANK    0
 #define CFG_JFFS2_NUM_BANKS     1
 
#else
 /* Flash banks JFFS2 should use */
 #define CFG_JFFS2_FIRST_BANK    1
 #define CFG_JFFS2_NUM_BANKS     1
 
#endif
#endif /* #if (CONFIG_COMMANDS & CFG_CMD_JFFS2) */


/*****************/
/* others        */
/*****************/
#define CFG_DFL_MV_REGS      0xd0000000    /* boot time MV_REGS */
#define CFG_MV_REGS      INTER_REGS_BASE /* MV Registers will be mapped here */

#undef CONFIG_USE_IRQ
#define CONFIG_STACKSIZE   (4 << 20)   /* regular stack - up to 4M (in case of exception)*/
#define CONFIG_NR_DRAM_BANKS    4

#endif                     /* __CONFIG_H */

and in the file /u-boot_88fxx81-1_7_3/board/mv88fxx81/mvSysHwConfig.h

/*******************************************************************************
Copyright (C) Marvell International Ltd. and its affiliates

********************************************************************************
Marvell GPL License Option

If you received this File from Marvell, you may opt to use, redistribute and/or
modify this File in accordance with the terms and conditions of the General
Public License Version 2, June 1991 (the "GPL License"), a copy of which is
available along with the File in the license.txt file or by writing to the Free
Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 or
on the worldwide web at http://www.gnu.org/licenses/gpl.txt.

THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ARE EXPRESSLY
DISCLAIMED.  The GPL License provides additional details about this warranty
disclaimer.

*******************************************************************************/
/*******************************************************************************
* mvSysHwCfg.h - Marvell system HW configuration file
*
* DESCRIPTION:
*       None.
*
* DEPENDENCIES:
*       None.
*
*******************************************************************************/

#ifndef __INCmvSysHwConfigh
#define __INCmvSysHwConfigh


#define MV_CACHEABLE(address) ((address) | 0x80000000)

/* includes */
#define _1K         0x00000400
#define _4K         0x00001000
#define _8K         0x00002000
#define _16K        0x00004000
#define _32K        0x00008000
#define _64K        0x00010000
#define _128K       0x00020000
#define _256K       0x00040000
#define _512K       0x00080000

#define _1M         0x00100000
#define _2M         0x00200000
#define _4M         0x00400000
#define _8M         0x00800000
#define _16M        0x01000000
#define _32M        0x02000000
#define _64M        0x04000000
#define _128M       0x08000000
#define _256M       0x10000000
#define _512M       0x20000000

#define _1G         0x40000000
#define _2G         0x80000000

/*
 *  System memory mapping
 */


/* SDRAM: actual mapping is auto detected */
#define SDRAM_CS0_BASE  0x00000000
#define SDRAM_CS0_SIZE  _256M

#define SDRAM_CS1_BASE  0x10000000
#define SDRAM_CS1_SIZE  _256M

#define SDRAM_CS2_BASE  0x20000000
#define SDRAM_CS2_SIZE  _256M

#define SDRAM_CS3_BASE  0x30000000
#define SDRAM_CS3_SIZE  _256M

/* PEX */
#define PEX0_MEM_BASE 0x90000000
#define PEX0_MEM_SIZE _128M

#define PEX0_IO_BASE 0xf0000000
#define PEX0_IO_SIZE _1M

/* PEX Work arround */
/* the target we will use for the workarround */
#define PEX_CONFIG_RW_WA_TARGET PEX0_MEM
/*a flag that indicates if we are going to use the
size and base of the target we using for the workarround
window */
#define PEX_CONFIG_RW_WA_USE_ORIGINAL_WIN_VALUES 1
/* if the above flag is 0 then the following values
will be used for the workarround window base and size,
otherwise the following defines will be ignored */
#define PEX_CONFIG_RW_WA_BASE 0x50000000
#define PEX_CONFIG_RW_WA_SIZE _16M


#if defined(MV_88F1181)                             

#define PEX1_MEM_BASE 0x98000000
#define PEX1_MEM_SIZE _128M

#define PEX1_IO_BASE 0xf0100000
#define PEX1_IO_SIZE _1M

#elif defined (MV_88F5181)                           
/* PCI0: IO and memory space */
#define PCI0_MEM_BASE  0x98000000
#define PCI0_MEM_SIZE  _128M

#define PCI0_IO_BASE    0xf0100000
#define PCI0_IO_SIZE    _1M

#else                                               
#   error "CHIP not selected"                       
#endif                                               

#if defined(MV_88F5181)                             
/* Device: CS0 - SRAM, CS1 - RTC, CS2 - UART, CS3 - large flash */
#define DEVICE_CS0_BASE 0xfa000000
#define DEVICE_CS0_SIZE _2M

#define DEVICE_CS1_BASE 0xf8000000

#define DEVICE_CS1_SIZE _32M

#define DEVICE_CS2_BASE 0xfa800000
#define DEVICE_CS2_SIZE _1M

#elif defined (MV_88F1181)                           

#define FLASH_CS_BASE 0xf8000000
#define FLASH_CS_SIZE _16M


#else                                               
#   error "CHIP not selected"                       
#endif                                               

/* Internal registers: size is defined in Controllerenvironment */
#define INTER_REGS_BASE   0xF1000000


#if defined(RD_88F5182) && defined(MV_TINY_IMAGE)

#define BOOTDEV_CS_BASE   0xFFFC0000
#define BOOTDEV_CS_SIZE _256K

#elif defined(RD_88F5181L_FE) || defined(RD_88F5181L_GE) || defined(RD_88F5182)

#define BOOTDEV_CS_BASE   0xFF000000
#define BOOTDEV_CS_SIZE _16M

#else

#define BOOTDEV_CS_BASE   0xff800000
#define BOOTDEV_CS_SIZE _8M

#endif

#if defined(MV_88F5182) || defined (MV_88F5181L)

#define CRYPT_ENG_BASE   0xFB000000
#define CRYPT_ENG_SIZE   _64K

#endif


/* DRAM detection stuff */
#define MV_DRAM_AUTO_SIZE

/* These addresses defines the place where global parameters will be placed   */
/* in case running from ROM. We Use SYS_MEM_TOP. See bootInit.c file      */
#define DRAM_DETECT_FLAG_ADDR    0x03000000
#define DRAM_CONFIG_ROM_ADDR    0x03000004

/* We use the following registers to store DRAM interface pre configuration   */
/* auto-detection results                                         */
/* IMPORTANT: We are using mask register for that purpose. Before writing     */
/* to units mask register, make sure main maks register is set to disable     */
/* all interrupts.                                                            */
#define DRAM_BUF_REG0   0x1011c   /* sdram bank 0 size           */ 
#define DRAM_BUF_REG1   0x20318   /* sdram config                 */
#define DRAM_BUF_REG2   0x20114   /* sdram mode                  */
#define DRAM_BUF_REG3   0x20320   /* dunit control low            */         
#define DRAM_BUF_REG4   0x20404   /* sdram address control        */
#define DRAM_BUF_REG5   0x2040c   /* sdram timing control low     */
#define DRAM_BUF_REG6   0x40108   /* sdram timing control high    */
#define DRAM_BUF_REG7   0x40114   /* sdram ODT control low        */
#define DRAM_BUF_REG8   0x41910   /* sdram ODT control high       */
#define DRAM_BUF_REG9   0x41a08   /* sdram Dunit ODT control      */
#define DRAM_BUF_REG10   0x41a30   /* sdram Extended Mode          */

/* Following the pre-configuration registers default values restored after    */
/* auto-detection is done                                                     */
#define DRAM_BUF_REG0_DV    0           /* GPIO Interrupt Level Mask Reg      */
#define DRAM_BUF_REG1_DV   0           /* ARM Timer 1 reload register        */
#define DRAM_BUF_REG2_DV    0           /* AHB to MBUS Bridge int Mask Reg    */
#define DRAM_BUF_REG3_DV   0           /* ARM Watchdog Timer Register        */
#define DRAM_BUF_REG4_DV   0           /* Host to ARM Doorbel Mask Register  */
#define DRAM_BUF_REG5_DV   0           /* ARM To Host Doorbel Mask Register  */
#define DRAM_BUF_REG6_DV   0           /* PCI Exp Uncorrectable Err Mask Reg */
#define DRAM_BUF_REG7_DV   0           /* PCI Exp Correctable Err Mask Reg   */
#define DRAM_BUF_REG8_DV   0           /* PCI Express interrupt Mask Reg     */
#define DRAM_BUF_REG9_DV   0           /* PCI Express Spare Register         */
#define DRAM_BUF_REG10_DV   0x012C0004  /* PCI Exp Acknowledge Timers (x4) Reg*/
 

#if defined (MV_88F5181)                         

/* Pex\PCI stuff */
#define PEX0_HOST_BUS_NUM      0
#define PEX0_HOST_DEV_NUM      0

#define PCI0_HOST_BUS_NUM      1
#define PCI0_HOST_DEV_NUM      0

/* no pci1 in MV_88F5181 */
#define PCI1_HOST_BUS_NUM      0
#define PCI1_HOST_DEV_NUM      0
/* no pex1 in MV_88F5181 */
#define PEX1_HOST_BUS_NUM      0
#define PEX1_HOST_DEV_NUM      0

#define PCI_ARBITER_CTRL    /* Use/unuse the Marvell integrated PCI arbiter   */
#undef   PCI_ARBITER_BOARD   /* Use/unuse the PCI arbiter on board         */

/* Check macro validity */
#if defined(PCI_ARBITER_CTRL) && defined (PCI_ARBITER_BOARD)
   #error "Please select either integrated PCI arbiter or board arbiter"
#endif




#elif defined (MV_88F1181)                           
/* Pex\PCI stuff */
#define PEX0_HOST_BUS_NUM      0
#define PEX0_HOST_DEV_NUM      0
/* we have a bridge */
#define PEX1_HOST_BUS_NUM      2
#define PEX1_HOST_DEV_NUM      0

/* no pci in MV_88F5181 */
#define PCI0_HOST_BUS_NUM      0
#define PCI0_HOST_DEV_NUM      0
#define PCI1_HOST_BUS_NUM      0
#define PCI1_HOST_DEV_NUM      0

#else                                               
#   error "CHIP not selected"                       
#endif                                               


/* Board clock detection */
#define TCLK_AUTO_DETECT    /* Use Tclk auto detection       */
#define SYSCLK_AUTO_DETECT   /* Use SysClk auto detection    */
#define PCLCK_AUTO_DETECT  /* Use PClk auto detection */


/* Memory uncached, HW or SW cache coherency is not needed */
#define MV_UNCACHED             0   
/* Memory cached, HW cache coherency supported in WriteThrough mode */
#define MV_CACHE_COHER_HW_WT    1
/* Memory cached, HW cache coherency supported in WriteBack mode */
#define MV_CACHE_COHER_HW_WB    2
/* Memory cached, No HW cache coherency, Cache coherency must be in SW */
#define MV_CACHE_COHER_SW       3


#if defined(MV_88F5181)                   
/************* Ethernet driver configuration ********************/

/*#define ETH_JUMBO_SUPPORT*/
/* HW cache coherency configuration */
#define DMA_RAM_COHER       NO_COHERENCY
#define ETHER_DRAM_COHER    MV_UNCACHED
#define INTEG_SRAM_COHER    MV_UNCACHED  /* Where integrated SRAM available */

#define ETH_DESCR_IN_SDRAM
#undef  ETH_DESCR_IN_SRAM

#if (ETHER_DRAM_COHER == MV_CACHE_COHER_HW_WB)
#   define ETH_SDRAM_CONFIG_STR      "MV_CACHE_COHER_HW_WB"
#elif (ETHER_DRAM_COHER == MV_CACHE_COHER_HW_WT)
#   define ETH_SDRAM_CONFIG_STR      "MV_CACHE_COHER_HW_WT"
#elif (ETHER_DRAM_COHER == MV_CACHE_COHER_SW)
#   define ETH_SDRAM_CONFIG_STR      "MV_CACHE_COHER_SW"
#elif (ETHER_DRAM_COHER == MV_UNCACHED)
#   define ETH_SDRAM_CONFIG_STR      "MV_UNCACHED"
#else
#   error "Unexpected ETHER_DRAM_COHER value"
 
#endif /* ETHER_DRAM_COHER */


/*********** Idma default configuration ***********/
#define UBOOT_CNTRL_DMA_DV     (ICCLR_DST_BURST_LIM_8BYTE | \
            ICCLR_SRC_INC | \
            ICCLR_DST_INC | \
            ICCLR_SRC_BURST_LIM_8BYTE | \
            ICCLR_NON_CHAIN_MODE | \
            ICCLR_BLOCK_MODE )
            
#elif defined (MV_88F1181)                           


#else                                               
#   error "CHIP not selected"                       
#endif                                               
            
#endif /* __INCmvSysHwConfigh */

task that the lines that interest are:

#else

#define BOOTDEV_CS_BASE   0xff800000
#define BOOTDEV_CS_SIZE _8M

#endif

and:

#define   CFG_ENV_IS_IN_FLASH         1
#define   CFG_ENV_SIZE            0xA000   /* Total Size of Environment Sector */
#define CFG_ENV_SECT_SIZE         0x10000
#define CFG_ENV_ADDR             (CFG_FLASH_BASE)

now:

# flash bank <driver> <base> <size> <chip_width> <bus_width> [driver_options ...]
driver -----------> cfi
base ------------> 0xFF800000
size -------------> 0xA000
chip_width -----> 1
bus_width ------> 1
driver_options -> jedec_probe

that is:

flash bank cfi 0xff800000 0xA000 1 1 jedec_probe

that of tasks?

Hi,

after weeks of hard investigations and a lot of unsuccessful tries, I was able to recover an original image using the serial port.

I had some trouble with my partly write-protected flash:
Marvell>> flinfo
Bank # 1: INTEL 28F640J3A (64 Mbit) or M58LW064D
Size:  8 MB,Bus Width: 2, device Width: 2.
Flash base: 0xff800000,Number of Sectors: 64 Type: REGULAR.
  Sector Start Addresses:
    ...
    003c0000      003e0000      00400000      00420000      00440000
(RO)
    ...
    006e0000      00700000      00720000      00740000      00760000 (RO)
    00780000 (RO) 007a0000 (RO) 007c0000 (RO) 007e0000 (RO)

Bank # 2: missing or unknown FLASH type

So, first I had to remove the write protection:
Marvell>> protect off 0xFFC40000 0xFFC5FFFF
Marvell>> flinfo
Bank # 1: INTEL 28F640J3A (64 Mbit) or M58LW064D
Size:  8 MB,Bus Width: 2, device Width: 2.
Flash base: 0xff800000,Number of Sectors: 64 Type: REGULAR.
  Sector Start Addresses:
    00000000      00020000      00040000      00060000      00080000     
    000a0000      000c0000      000e0000      00100000      00120000     
    00140000      00160000      00180000      001a0000      001c0000     
    001e0000      00200000      00220000      00240000      00260000     
    00280000      002a0000      002c0000      002e0000      00300000     
    00320000      00340000      00360000      00380000      003a0000     
    003c0000      003e0000      00400000      00420000      00440000
    00460000      00480000      004a0000      004c0000      004e0000     
    00500000      00520000      00540000      00560000      00580000     
    005a0000      005c0000      005e0000      00600000      00620000     
    00640000      00660000      00680000      006a0000      006c0000     
    006e0000      00700000      00720000      00740000      00760000 (RO)
    00780000 (RO) 007a0000 (RO) 007c0000 (RO) 007e0000 (RO)

Bank # 2: missing or unknown FLASH type

The second step was to download the original netgear firmware to the router memory:
Marvell>> tftpboot 0 wnr854t_1_4_33_ww.img

After erasing the flash (partially) we can copy the original image:
Marvell>> erase 0xFF800000 0xFFDFFFFF

The original firmware has prefix (a router specific header) we won't copy to the flash:
Marvell>> cp.b 0x14 0xFF800000 0x600000

Last but not least we have to start the image:
Marvell>> run standalone

Playing around with my router I lost the original environment of the u-boot loader. That's why I have to start the system manually (run standalone) every time the router reboots.
Now I only have the default environment:
Marvell>> printenv
bootargs=console=ttyS0,115200 mtdparts=phys_mapped_flash:15m(root),1m@15m(uboot)ro
bootcmd=tftpboot 0x400000 $(image_name); setenv bootargs $(bootargs) $(bootargs_root) nfsroot=$(serverip):$(rootpath)  ip=$(ipaddr):$(serverip)$(bootargs_end);  bootm 0x400000;
baudrate=115200
loads_echo=0
ipaddr=10.4.50.146
serverip=10.4.50.4
rootpath=/mnt/ARM_FS/
stdin=serial
stdout=serial
stderr=serial
cpuName=926
CASset=min
enaMonExt=no
enaFlashBuf=yes
enaCpuStream=no
MALLOC_len=4
ethprime=egiga0
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:eth0:none
image_name=uImage
standalone=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootdelay=1
disaMvPnp=no
ethaddr=00:00:00:00:51:81
overEthAddr=no
usb0Mode=host
ethact=egiga0

Environment size: 816/40956 bytes

Is anybody out there who can send me the original settings ????

hi mfd,
I have as soon as acquired ARM-USB-TINY and use ubuntu, I have executed the following steps:
1) apt-get install libftdi-dev
2) apt-get install libc6
3) apt-get install libftdi0
4) apt-get install libusb-0.1-4
5) svn checkout svn://svn.berlios.de/openocd/trunk
6) ./bootstrap
7) ./configure --enable-ft2232_libftdi
8) make && make install

and used the following configuration wnr854t.cfg:

the connector hardware 20-pin TINY 10-pin WND854T is following:

# daemon config
telnet_port 4444
gdb_port 3333
daemon_startup attach

#interface
interface ft2232
ft2232_device_desc "Olimex OpenOCD JTAG TINY"
ft2232_layout jtagkey
ft2232_vid_pid 0x15ba 0x0004
jtag_speed 2
#use combined on interfaces or targets that can't set TRST/SRST separately
#reset_config trst_and_srst srst_pulls_trst 
reset_config trst_only

# use combined on interfaces or targets that can't set TRST/SRST separately
#reset_config srst_only
#reset_config trst_and_srst
#reset_config trst_only

# jtag scan chain
#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)
jtag_device 4 0x1 0xf 0xe

#jtag_nsrst_delay 500
#jtag_ntrst_delay 500

# target configuration
# target <type> <endianess> <reset_mode>
# if chain_pos is not zero it seg faults
#target arm926ejs little reset_init 0
target feroceon little reset_init 0
run_and_halt_time 0 30
#working_area 0 0xc8010000 0x400 nobackup

# flash configuration
# flash bank <driver> <base> <size> <chip_width> <bus_width> [driver_options ...]
flash bank cfi 0xff800000 0xA000 1 1 jedec_probe

the connector hardware 20-pin TINY <------> 10-pin WND854T is following:
20-pin TINY <------> 10-pin WND854T (Jtag)
      1-VREF  <------->   1
         2      <------->   2
  3-TRST_N <------->   9
      4-GND <------->   3
      5-TDI   <------->   4
      6-GND  <------->   5
      7-TMS  <------->   6
      9-TCK  <------->   8
     13-TDO <------->   7

to premise that u-boot it is damaged, executing openocd I receive the following messages:

root@massimo-desktop:/opt/openocd/trunk/src# openocd -d3 -f wnr854t.cfg
Open On-Chip Debugger 1.0 (2008-04-26-22:37) svn:623
$URL: svn://svn.berlios.de/openocd/trunk/src/openocd.c $
Debug:   5 0 command.c:386 command_run_line(): script wnr854t.cfg
Debug:   6 0 configuration.c:87 open_file_from_path(): opened wnr854t.cfg
Debug:   7 1 command.c:386 command_run_line(): telnet_port 4444
Debug:   8 1 command.c:386 command_run_line(): gdb_port 3333
Debug:   9 1 command.c:386 command_run_line(): daemon_startup attach
Info:    10 1 options.c:50 configuration_output_handler(): Open On-Chip Debugger 1.0 (2008-04-26-22:37) svn:623
Debug:   11 1 command.c:386 command_run_line(): interface ft2232
Debug:   12 1 command.c:386 command_run_line(): ft2232_device_desc "Olimex OpenOCD JTAG TINY"
Debug:   13 1 command.c:386 command_run_line(): ft2232_layout jtagkey
Debug:   14 1 command.c:386 command_run_line(): ft2232_vid_pid 0x15ba 0x0004
Debug:   15 1 command.c:386 command_run_line(): jtag_speed 2
Debug:   16 1 jtag.c:1843 handle_jtag_speed_command(): handle jtag speed
Info:    17 1 options.c:50 configuration_output_handler(): jtag_speed: 2, 2
Debug:   18 1 command.c:386 command_run_line(): reset_config trst_only
Debug:   19 1 command.c:386 command_run_line(): jtag_device 4 0x1 0xf 0xe
Debug:   20 1 command.c:386 command_run_line(): target feroceon little reset_init 0
Debug:   21 1 feroceon.c:600 feroceon_target_command(): chain_pos: 0, variant: (null)
Debug:   22 1 command.c:386 command_run_line(): run_and_halt_time 0 30
Debug:   23 1 command.c:386 command_run_line(): flash bank cfi 0xff800000 0xA000 1 1 jedec_probe
Debug:   24 1 command.c:386 command_run_line(): init
Debug:   25 2 openocd.c:102 handle_init_command(): target init complete
Debug:   26 2 ft2232.c:1455 ft2232_init_libftdi(): 'ft2232' interface using libftdi with 'jtagkey' layout (15ba:0004)
Debug:   27 38 ft2232.c:1497 ft2232_init_libftdi(): current latency timer: 2
Debug:   28 40 ft2232.c:1683 jtagkey_init(): 80 08 1b
Debug:   29 42 ft2232.c:1741 jtagkey_init(): 82 09 0f
Debug:   30 44 ft2232.c:252 ft2232_speed(): 86 02 00
Debug:   31 48 openocd.c:109 handle_init_command(): jtag interface init complete
Debug:   32 48 jtag.c:1526 jtag_init_inner(): Init JTAG chain
Debug:   33 48 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   34 48 jtag.c:1282 jtag_reset_callback(): -
Debug:   35 50 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   36 50 jtag.c:1282 jtag_reset_callback(): -
Error:   37 54 jtag.c:1338 jtag_examine_chain(): JTAG communication failure, check connection, JTAG interface, target power etc.
Error:   38 54 jtag.c:1545 jtag_init_inner(): trying to validate configured JTAG chain anyway...
Debug:   39 54 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   40 55 jtag.c:1282 jtag_reset_callback(): -
Error:   41 57 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   42 95 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   43 95 jtag.c:1282 jtag_reset_callback(): -
Error:   44 100 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   45 114 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   46 114 jtag.c:1282 jtag_reset_callback(): -
Error:   47 134 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   48 148 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   49 148 jtag.c:1282 jtag_reset_callback(): -
Error:   50 170 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   51 188 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   52 188 jtag.c:1282 jtag_reset_callback(): -
Error:   53 205 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   54 218 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   55 218 jtag.c:1282 jtag_reset_callback(): -
Error:   56 237 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Error:   57 237 jtag.c:1554 jtag_init_inner(): Could not validate JTAG chain, exit
Debug:   58 237 jtag.c:1570 jtag_init_reset(): Trying to bring the JTAG controller to life by asserting TRST / tms
Debug:   59 237 jtag.c:989 jtag_add_reset(): SRST line released
Debug:   60 237 jtag.c:1008 jtag_add_reset(): TRST line asserted
Debug:   61 237 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   62 237 jtag.c:1282 jtag_reset_callback(): -
Debug:   63 237 jtag.c:989 jtag_add_reset(): SRST line released
Debug:   64 237 ft2232.c:958 jtagkey_reset(): trst: 1, srst: 0, high_output: 0x08, high_direction: 0x0f
Debug:   65 237 ft2232.c:958 jtagkey_reset(): trst: 0, srst: 0, high_output: 0x09, high_direction: 0x0f
Debug:   66 238 jtag.c:1526 jtag_init_inner(): Init JTAG chain
Debug:   67 238 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   68 238 jtag.c:1282 jtag_reset_callback(): -
Debug:   69 240 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   70 240 jtag.c:1282 jtag_reset_callback(): -
Error:   71 244 jtag.c:1338 jtag_examine_chain(): JTAG communication failure, check connection, JTAG interface, target power etc.
Error:   72 244 jtag.c:1545 jtag_init_inner(): trying to validate configured JTAG chain anyway...
Debug:   73 244 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   74 244 jtag.c:1282 jtag_reset_callback(): -
Error:   75 246 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   76 260 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   77 260 jtag.c:1282 jtag_reset_callback(): -
Error:   78 283 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   79 298 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   80 298 jtag.c:1282 jtag_reset_callback(): -
Error:   81 316 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   82 329 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   83 329 jtag.c:1282 jtag_reset_callback(): -
Error:   84 346 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   85 358 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   86 358 jtag.c:1282 jtag_reset_callback(): -
Error:   87 362 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Debug:   88 375 jtag.c:319 jtag_call_event_callbacks(): jtag event: JTAG controller reset(tms or TRST)
Debug:   89 375 jtag.c:1282 jtag_reset_callback(): -
Error:   90 391 jtag.c:1431 jtag_validate_chain(): Error validating JTAG scan chain, IR mismatch, scan returned 0x3f
Error:   91 391 jtag.c:1554 jtag_init_inner(): Could not validate JTAG chain, exit
Debug:   92 391 openocd.c:126 handle_init_command(): flash init complete
Debug:   93 391 openocd.c:130 handle_init_command(): NAND init complete
Debug:   94 391 openocd.c:134 handle_init_command(): pld init complete
Debug:   95 391 gdb_server.c:2030 gdb_init(): gdb service for target feroceon at port 3333
Info:    96 4960 server.c:78 add_connection(): accepting 'telnet' connection from 0
Debug:   97 8029 command.c:386 command_run_line(): halt
Debug:   98 8030 target.c:1785 handle_halt_command(): -
Error:   99 8030 target.c:272 target_halt(): Target not examined yet
Debug:   100 8030 command.c:343 find_and_run_command(): Command failed with error code -4
Debug:   101 11251 command.c:386 command_run_line(): poll
User:    102 11251 target.c:936 target_arch_state(): target state: unknown
Debug:   103 18402 command.c:386 command_run_line(): soft_reset_halt
User:    104 18402 target.c:1800 handle_soft_reset_halt_command(): requesting target halt and executing a soft reset
Error:   105 18402 target.c:516 target_soft_reset_halt_imp(): Target not examined yet

mfd, you can help to find the solution me in way to restore u-boot in my device?

tanks you


the only information that I can give in reference to your problem are these, made when it worked u-boot:

 0  
### JFFS2 loading 'uImage' to 0x400000                                      
Scanning JFFS2 FS: .. done.                           
### JFFS2 load complete: 900120 bytes loaded to 0x400000                                                        
## Booting image at 00400000 ...                                
   Image Name:   Linux-2.4.27-vrs1                                  
   Created:      2006-12-11   5:20:50 UTC                                         
   Image Type:   ARM Linux Kernel Image (uncompressed)                                                      
   Data Size:    900056 Bytes = 879 kB                                      
   Load Address: 00008000                         
   Entry Point:  00008000                         
   Verifying Checksum ... OK                            
OK  

Starting kernel ...                   

Uncompressing Linux.............................................................                                                                                
. done, booting the kernel.                           
ZLinux version 2.4.27-vrs1 (joshua@localhost.localdomain) (gcc version 3.4.4 (re                                                                                
lease) (CodeSourcery ARM 2005q3-1)) #20 Mon Dec 11 13:19:42 CST 2006                                                                    
CPU: ARM926EJ-Sid(wb) revision 0                                
Machine: MV-88fxx81                   
Using UBoot passing parameters structure                                        
Sys Clk = 166000000, Tclk = 166000000                                     


- Warning - This LSP release was tested only with U-Boot release 1.7.3                                                                      

On node 0 totalpages: 8192                          
zone(0): 8192 pages.                    
zone(1): 0 pages.                 
zone(2): 0 pages.                 
Kernel command line: console=ttyS0,115200 root=/dev/                                                  
192.168.1.101:::DB88FXX81:eth0:none                                   
gppMask = [0x130]                 
Calibrating delay loop... 331.77 BogoMIPS                                         
Memory: 32MB 0MB 0MB 0MB = 32MB total                                     
Memory: 30292KB available (1681K code, 326K data, 72K init)                                                           
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)                                                             
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)                                                            
Mount cache hash table entries: 512 (order: 0, 4096 bytes)                                                          
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)                                                            
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)                                                           
CPU: Testing write b                   
POSIX conformance testing by UNIFIX                                   
init hw started.                

CPU Interface             
-------------             
SDRAM_CS0 ....base 00000000, size  32MB                                       
SDRAM_CS1 ....disable                     
SDRAM_CS2 ....disable                     
SDRAM_CS3 ....disable                     
PEX0_MEM ....base e0000000, size 128MB                                      
PEX0_IO ....base f2000000, size   1MB                                     
PCI0_MEM ....base e8000000, size 128MB                                      
PCI0_IO ....base f2100000, size   1MB                                     
INTER_REGS ....base f1000000, size   1MB                                        
DEVICE_CS0 ....no such                      
DEVICE_CS1 ....no such                      
DEVICE_CS2 ....no such                      
DEV_BOOCS ....base f4000000, size  16MB                                       
PCI: bus0: Fast back to back                             
HW already initialized.                       
PCI: bus1: Fast back to back transfers enabled                                              
Linux NET4.0 for Linux 2.4                          
Based upon Swansea University Computer Society NET3.039                                                       
Initializing RT netlink socket                              
 bankwidth 2, base f4000000, size 1000000                                         

  Marvell Development Board (LSP Version 1.0.4)-- RD-88F5181L-VOIP-GE                                                                     

 Detected Tclk 166000000 and SysClk 166000000                                             
Starting kswapd               
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)                                                             
devfs: boot_options: 0x1                        
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communicati                                                                     
pty: 256 Unix98 ptys configured                               
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en                                                                                
abled     
ttyS00 at 0xf1012000 (irq = 3) is a 16550A                                          
Marvell Gigabit Ethernet Driver 'egiga':                                        
  o Ethernet descriptors in DRAM                                
  o DRAM SW cache-coherency                           
  o Loading network interface                             
  o Using switch header mode                            
qdInit      
BoardID = eqdStart: CPU port 0x3                                
----set PPU En              
Switch driver initialized                         
Can't get netConfig: Use default                                
UNM is not initialized yet                          
2 VLANs created: CpuPortMask = 0xa7                                   
vid=0:  DISABLED(0), portMask=0x750, portNum=5                                              
vid=1:       VLAN_1, portMask=0x04, portNum=1                                             
vid=2:       VLAN_2, portMask=0xa3, portNum=4                                             
vid=12: ISOLATED(12), portMask=0x00, portNum=0                                              
Port - Vlan           
 0  - VLAN_2            
 1  - VLAN_2            
 2  - VLAN_1            
 3  - VLAN_ALL              
 4  - DISABLED(0)                 
 5  - VLAN_2            
 6  - DISABLED(0)                 
 7  - VLAN_2            
load virtual interface vid = 1                              
 register if with name                      
Init the hal            
: Ilegal MTU value 1500,  rounding MTU to: 1506                                               
 if eth0 registered                   
load virtual interface vid = 2                              
 register if with name                      
 if eth1 registered                  
PPP generic driver version 2.4.2                                
physmap flash device: 1000000 at f4000000                                         
cfi_cmdset_0001: Erase suspend on write enabled                                               
Using buffer write method                         
Using physmap partition definition                                  
Creating 6 MTD partitions on "phys_mapped_flash":                                                 
0x00000000-0x00600000 : "root"                              
0x00600000-0x00620000 : "nvram"                               
0x00620000-0x00640000 : "nvram default"                                       
0x00640000-0x00660000 : "POT"                             
0x00660000-0x00680000 : "Traffic Meter"                                       
0x00700000-0x00800000 : "uboot"                               
Initializing Cryptographic API                              
NET4: Linux TCP/IP 1.0 for NET4.0                                 
NET4: Linux TCP/IP 1.0 for NET4.0                                 
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (8192 buckets, 65536 max) - 348 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
ipt_time loading
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
Fast Floating Point Emulator V0.94M by Peter Teichmann.
cramfs: wrong magic
jffs2_scan_inode_node(): Data CRC failed on node at 0x0037bd70: Read 0x764044df,
 calculated 0x00e21be9
VFS: Mounted root (jffs2 filesystem).
Mounted devfs on /dev
Freeing init memory: 72K
8Z

BusyBox v1.1.0 (2006.12.07-07:38+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/bin/sh: can't access tty; job control turned off
/ #
Marvell>> tftpboot 00000000 file_image.img
Filename 'file_image.img'.
Load address: 0x0
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###########################################################
done
Bytes transferred = 6291476 (600014 hex)
Marvell>>
Marvell>> bootm 00000000
## Booting image at 00000000 ...
Bad Magic Number
Marvell>>
Marvell>> flinfo

Bank # 1: INTEL 28F640J3A (64 Mbit)
Size:  8 MB,Bus Width: 2, device Width: 2.
Flash base: 0xff800000,Number of Sectors: 64 Type: REGULAR.
  Sector Start Addresses:
    00000000      00020000      00040000      00060000      00080000
    000a0000      000c0000      000e0000      00100000      00120000
    00140000      00160000      00180000      001a0000      001c0000
    001e0000      00200000      00220000      00240000      00260000
    00280000      002a0000      002c0000      002e0000      00300000
    00320000      00340000      00360000      00380000      003a0000
    003c0000      003e0000      00400000      00420000      00440000
    00460000      00480000      004a0000      004c0000      004e0000
    00500000      00520000      00540000      00560000      00580000
    005a0000      005c0000      005e0000      00600000      00620000
    00640000      00660000      00680000      006a0000      006c0000
    006e0000      00700000      00720000      00740000      00760000 (RO)
    00780000 (RO) 007a0000 (RO) 007c0000 (RO) 007e0000 (RO)

Bank # 2: missing or unknown FLASH type
Marvell>>

(Last edited by omissam1972 on 27 Apr 2008, 11:06)

Hello Massimo,

I am not sure if I can really help you but maybe I can give you a hint to solve the problem with your jtag adapter.

I am using a parallel buffered wiggler cable as described here: http://wiki.openwrt.org/OpenWrtDocs/Cus … JTAG_Cable
When I started the jtag adapter for the first time I got a lot of messages
...
Error:   jtag.c:1384 jtag_validate_chain(): Error validating JTAG scan chain, IR  mismatch, scan returned 0x00
Error:   jtag.c:1384 jtag_validate_chain(): Error validating JTAG scan chain, IR  mismatch, scan returned 0x00
...

After enabling the parallel port on bios level these messages were gone.
Maybe you have a similar problem with your interface, your power supply or a broken chip.

In the meantime I broke down my device saving the environment (saveenv). I haven't got a console output anymore and up to now I also haven't found a way to reactivate it.
Using my jtag adapter isn't an alternative because I am neither able to stop the device nor to access the flash.

I am using the latest openocd snapshot with the following configuration file:

#daemon configuration 
telnet_port 4444 
gdb_port 3333 
daemon_startup attach

#interface 
interface parport 
parport_port 0x378 
parport_cable wiggler 
jtag_speed 1

# use combined on interfaces or targets that can't set TRST/SRST separately 
reset_config srst_only 

# jtag scan chain 
#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE) 
jtag_device 4 0x1 0xf 0xe 

# target configuration 
# target <type> <endianess> <reset_mode> 
target feroceon little reset_init 0 
run_and_halt_time 0 30 

# flash configuration 
# flash bank <driver> <base> <size> <chip_width> <bus_width> [driver_options ...] 
flash bank cfi 0xff800000 0x00800000 2 2 jedec_probe

Do you know
- if the Marvell Ferocon 88F5181 is supported by OpenOCD,
- how to stop the device and/or
- how to reactivate the console output for u-boot ?

Regards mfd

OpenOCD can stop the device as expected, beginning with r950, which was a patch I submitted.

mfd wrote:

...
Is anybody out there who can send me the original settings ????

I just came across this thread today and just in case someone else needs the U-Boot settings here are mine (output of "printenv" on the bootloader prompt):

baudrate=115200
loads_echo=0
rootpath=/mnt/ARM_FS/
cpuName=926
CASset=min
MALLOC_len=4
ethprime=egiga0
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:eth0:none
ethaddr=00:00:00:00:51:81
usb0Mode=host
ethact=egiga0
filesize=600000
fileaddr=1100000
ipaddr=192.168.1.1
serverip=192.168.1.101
image_name=uImage
bootargs2=console=ttyS0,115200
standalone=fsload 0x400000 $(image_name);setenv bootargs $(bootargs2) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootnfs=fsload 0x400000 $(image_name);setenv bootargs $(bootargs2) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootcmd=fsload 0x400000 $(image_name);setenv bootargs $(bootargs2) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
stdin=serial
stdout=serial
stderr=serial
enaMonExt=no
enaFlashBuf=yes
enaCpuStream=no
bootdelay=1
disaMvPnp=no
overEthAddr=no

Environment size: 918/40956 bytes

I succeeded connect the router with openocd. But I need a u-boot.bin or full image dump for burning.
Anyone could upload a dump for that?
The u-boot.bin in GPL Source Code did not work.

u-boot.bin starts from nor flash 0xFFF80000, the length is 0x80000.

(Last edited by axot on 25 Oct 2012, 03:46)

here is my cfg file.
openocd version: 0.5.0

source [find openjtag.cfg]

set CPUTAPID 0x07926041
source [find /usr/local/share/openocd/scripts/target/feroceon.cfg]

$_TARGETNAME configure -work-area-phys 0x00400000 -work-area-size 0x40000 -work-area-backup 0

jtag_rclk 3000

arm7_9 dcc_downloads enable
arm7_9 fast_memory_access enable

set _FLASHNAME $_CHIPNAME.flash
flash bank $_FLASHNAME cfi 0xff800000 0x800000 2 2 $_TARGETNAME jedec_probe

$_TARGETNAME configure -event reset-init {
    # MPP
    mww 0xF1010000 0x55000003
    mww 0xF1010004 0x11110010
    mww 0xF1010050 0x00001111
    mww 0xF1010008 0x00000000

    # GPP
    mww 0xF1010104 0xFFFF0330

    # SDRAM
    mww 0xF1001480 0x00000001

    # PCI ARBITER
    mww 0xF1031d00 0x80000030

    flash probe 0
}
proc wuboot { } {
    flash erase_address 0xfff80000 0x80000
    flash write_image erase ../binary/u-boot.bin 0xFFF80000
    reset run
    resume
}

(Last edited by axot on 27 Oct 2012, 16:23)

FYI - this config was crashing OpenOCD 0.9, here's a working config.

Just connect everything up, adjust your path for the uboot binary and issue wuboot to write the file to flash.

source [find ../scripts/interface/ftdi/tumpa.cfg]

set CPUTAPID 0x07926041
source [find ../scripts/target/feroceon.cfg]

adapter_khz 1000

arm7_9 dcc_downloads enable
arm7_9 fast_memory_access enable

set _FLASHNAME $_CHIPNAME.flash
flash bank $_FLASHNAME cfi 0xff800000 0x800000 2 2 $_TARGETNAME jedec_probe

$_TARGETNAME configure -event reset-init {
    # MPP
    mww 0xF1010000 0x55000003
    mww 0xF1010004 0x11110010
    mww 0xF1010050 0x00001111
    mww 0xF1010008 0x00000000

    # GPP
    mww 0xF1010104 0xFFFF0330

    # SDRAM
    mww 0xF1001480 0x00000001

    # PCI ARBITER
    mww 0xF1031d00 0x80000030

    flash probe 0
}
proc wuboot { } {
   reset halt
    flash erase_address 0xfff80000 0x80000
    flash write_image erase unlock d:/temp/wnr854t/openocd-0.9.0/binary/u-boot.bin 0xFFF80000
    reset run
   resume
}

The discussion might have continued from here.