I've been playing around with a lot of mpc85xx-based boards. One issue I've found with them is that while all of them boot using U-Boot, the implementations are not consistent: For example:
- On boot, the WS-AP3825i relocates the fdt/dtb too high in memory for the OpenWrt Linux kernel to read it (the older OEM Linux kernel has no problems with this).
- The HiveAP 330 and HiveAP 370 have hard-coded bootcmd strings which need to be binary-patched before they can continue to work.
- The HiveAP 330's gzip implementation cannot decompress Linux kernels greater than 7MB, meaning kernels now have to be built uncompressed.
- The TP-LINK TL-WDR4900 has related issues regarding booting compressed kernels.
- The HP MSM466 appears to refuse to boot at all.
In the past, it has not been feasible to build a replacement U-Boot, as the JTAG implementation available on these boards is not fully publicly documented.
I recently acquired a BDI2000 and have it working with an MSM466 (see these threads for more details about these boards, and fohdeesha for a demonstration using the BDI2000 on this platform). I am documenting the process of building a U-Boot replacement here.
To summarize where I am: I've got U-Boot building for the "p1_p2" (P10XX platform). The two main steps for me are:
I need either reconfigure U-Boot to do only those portions of platform configuration not done by the BDI2000, or configure the BDI2000 to perform exactly those steps done by the U-Boot SPL and TPL (RAM init and loading the main U-Boot into RAM). Once I've gotten the behavior of U-Boot and the BDI2000 aligned, I can rewrite the flash "from RAM" (and rescue myself from a dead U-Boot flash).
I then need to build U-Boot so that it can run on its own.
Right now, I'm playing around with the BDI2000 and trying to get it to either initialize or load data into RAM properly, not sure which is the issue.