1 (edited by Dioptimizer 2012-04-20 13:51:09)

Topic: Debrick Routers with AR724x processors Using JTAG

Hello.

After analyzing a lot of routers (with including the EJTAG port) with processor AR724x  I can confirm of some of the pins used for de-bricking.
Very often meet routers that do not have labels with marking the start numbering pins of the processor.
To help You find the right pins, I wrote this illustration:

         128                97
           |                 |
      Lock-+-----------------+-96
           |                 |
           |       /\        |
DDR Chip - |     /----\      | - SPI (or NAND) Flash Chip
           |   /        \    |
           |     AR724x      |
           |                 |
        32-+-----------------+-65
           |                 |
          33                64 
                    |
                 Ethernet

AR724x CPUs:
EJTAG v3.1 pinout:

80pin  | 81pin  | 82pin | 84pin  | 85pin | 93pin
nTRST |  TDI  |  TDO  |  TMS  |  TCK  | RST ([s]nSRST[/s])

UART pinout:

 86pin | 87pin 
   Rx  |  Tx

If on PCB board of the router no place to EJTAG, then it is usually nTRST, TDI, TDO, TMS, TCK pins is used as a GPIOs pins.
But RST ([s]nSRST[/s]) pin is always connected to the VCC line (usually via a resistor) and is also a GPIO-pin.
Unlike nSRST which resets the CPU but JTAG is still active.
RST - also disables the JTAG, ie full chip reset (same as off/on the router).

On processors AR7241 and AR7242 (Critical for the routers with SPI Flash Memory) was changed the location of the CS# for Flash Chip (compared with an AR7240, where CS#-pin = 75-pin) and designated as a 80-pin = CS# - i.e. on one pin is located nTRST, CS# and GPIO.

When using the EJTAG on the router, usually nTRST (negative TAP Reset) is connected to VCC line – this way enabled TAP controller. Simply Wiggler JTAG cable used nTRST always pulled to the VCC for logical "1" (after the initialization of the cable) - it is usually necessary to confirm the MIPS EJTAG specification. As You can understand it is critical for SPI flash-chip that needs CS#.
More information about the EJTAG specification can be found at this link.

In practical use was discovered that the router MR3220v1.2 (AR7241) is still possible to use and JTAG interface and the SPI Flash Chip via JTAG interface as follows:

After pre-connecting to the router Simply DLC5 JTAG cable (this cable is only used: TDI, TDO, TMS, TCK pins) I made a manual nTRST switch, by soldering the Button between the CS# and VCC line (between this lines need to use resistor 10…50 ohms).

1. Turn-off the router
2. Connect the JTAG cable to Router and PC
3. Press and hold the button (manual nTRST)
4. Turn-on the router (wait until 2 .... 3 sec)
5. Depress the button (manual nTRST) - in this case the router or the AR7241 processor will be in TAP mode
6. After that we need use the program for JTAG and we have access to the flash chip.

Links:
http://www.linux-mips.org/wiki/JTAG
http://infodepot.wikia.com/wiki/TJTAG
http://www.wehavemorefun.de/fritzbox/index.php/EJTAG

Re: Debrick Routers with AR724x processors Using JTAG

Why o0n earth don't you use the wiki to document stuff?

3 (edited by Dioptimizer 2012-04-20 14:53:37)

Re: Debrick Routers with AR724x processors Using JTAG

Configuration (taget) file ar724x.cfg for OpenOCD:

# Atheros AR724x MIPS 24Kc SoC.
# tested on AP99 refererence board
#
# this settings are taken from source of u-boot for this board
# (for PLL) file:    u-boot/board/ar7240/common/lowlevel_init.S
# (for DDR) file:    u-boot/cpu/mips/ar7240/meminit.c
#      with file:    u-boot/include/configs/ap99.h

adapter_nsrst_delay 100
jtag_ntrst_delay 100

reset_config trst_only separate            ;# or use only "reset_config none"

set CHIPNAME ar724x

jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1

set TARGETNAME $CHIPNAME.cpu
target create $TARGETNAME mips_m4k -endian big -chain-position $TARGETNAME

$TARGETNAME configure -event reset-init {
    #reset Watchdog Timer
    mww 0xb8060008 3            ;# rst watchdog timer control        <
    mww 0xb806000c 0x12c        ;# rst watchdog timer (resets SoC)    >
    sleep 10
    halt
    wait_halt

    #setup PLL to lowest(default) common denominator 400/400/200 setting
    mww 0xb8050000 0x00090828        ;# clr pll mask (rst: 02090828)
    mww 0xb8050000 0x00050828        ;# CPU:400 DDR:400 AHB:200
    mww 0xb8050000 0x00040828        ;# clr pll bypass

    #next command will reset for PLL changes to take effect 
    mww 0xb8050008 2            ;# set reset_switch
    mww 0xb8050008 3            ;# set clock_switch (resets SoC)
    sleep 10
    halt
    wait_halt

    #complete pll initialization
    mww 0xb8050008 0            ;# set reset_switch bit & clock_switch bit
    
    # Setup DDR config and flash mapping
    mww 0xb8000000 0xc7bc8cd0        ;# DDR cfg cdl val (rst: 77be8cd0)
    mww 0xb8000004 0x9dd0e6a8        ;# DDR cfg2 cdl val (rst: 99d10628)

    mww 0xb8000010 8            ;# force precharge all banks
    mww 0xb8000008 0x133            ;# DDR mode value init
    mww 0xb8000010 1            ;# force EMRS update cycle
    mww 0xb800000c 0            ;# clr ext. mode register

    mww 0xb8000010 2            ;# force auto refresh all banks
    mww 0xb8000010 8            ;# force precharge all banks
    mww 0xb8000008 0x33            ;# set DDR mode value CAS=3
    mww 0xb8000010 1            ;# force EMRS update cycle
    mww 0xb8000014 0x4f10        ;# DDR refresh value
    mww 0xb8000018 0xff            ;# DDR Read Data This Cycle value (16bit: 0xffff)
    mww 0xb800001c 2            ;# delay added to the DQS0 line (normal = 8)
    mww 0xb8000020 2            ;# delay added to the DQS1 line (normal = 9)
    mww 0xb8000024 0
    mww 0xb8000028 0
}

# setup working area somewhere in RAM
$TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000

# serial SPI capable flash
# flash bank <driver> <base> <size> <chip_width> <bus_width>

OpenOCD log when connected board:

D:\Free\OpenOCD\0.5.0>openocd-0.5.0.exe -f interface\parport.cfg -f target\ar724x.cfg
Open On-Chip Debugger 0.5.0 (2012-04-06-14:30)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.berlios.de/doc/doxygen/bugs.html
Warn : Adapter driver 'parport' did not declare which transports it allows; assu
ming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
parport port = 0x378
6000 kHz
adapter_nsrst_delay: 100
jtag_ntrst_delay: 100
none separate
131072
Info : clock speed 500 kHz
Info : JTAG tap: ar724x.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0
000, ver: 0x0)
Info : accepting 'telnet' connection from 4444

My telnet log:

Open On-Chip Debugger
> reset
JTAG tap: ar724x.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc03860
> reset
JTAG tap: ar724x.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc03860
> mww 0xb8060008 3
> mww 0xb806000c 0x12c
in procedure 'mww'
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc03860
> mww 0xb8050000 0x00090828
> mww 0xb8050000 0x00050828
> mww 0xb8050000 0x00040828
> mww 0xb8050008 2
> mww 0xb8050008 3
in procedure 'mww'
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc03860
> reset init
JTAG tap: ar724x.cpu tap/device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0)
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0xbfc03860
> load_image backup_fullflash.bin 0x81000000
4194304 bytes written at address 0x81000000
downloaded 4194304 bytes in 434.899994s (9.418 KiB/s)
> load_image 8Muboot_RAM_version.bin 0x80000000
262144 bytes written at address 0x80000000
downloaded 262144 bytes in 21.150000s (12.104 KiB/s)
> resume 0x80000000

If you see error "in procedure 'mww'" - its bug OpenOCD.
reset init - for my build of OpenOCD (with bugs), I changed init script so that it begins with "# complete pll initialization".


Parallel you should use UART and you will see:

U-Boot 1.3.0-TT-0.1.0 (Nov 29 2011 - 19:25:10)@TTHR

              IN DEBUG MODE

AP99 (ar7241 - Virian) U-boot
#### TAP VALUE 1 = 0x2, 2 = 0x2 [0x0: 0x0]
CPU_FREQ=400##DDR_FREQ=400##AHB_FREQ=200
DRAM:  32 MB
uboot_end=[0x80030320]###len=[0x30320]Top of RAM usable for U-Boot at: 82000000
Reserving 192k for U-Boot at: 81fcc000
Reserving 192k for malloc() at: 81f9c000
Reserving 44 Bytes for Board Info at: 81f9bfd4
Reserving 36 Bytes for Global Data at: 81f9bfb0
Reserving 128k for boot params() at: 81f7bfb0
Stack Pointer at: 81f7bf98
Now running in RAM - U-Boot at: 81fcc000
Flash:  8 MB
Using default environment


Warnning Board Uncolabrated!!
In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
Virian MDC CFG Value ==> 4
: cfg1 0xf cfg2 0x7014
eth0: 40:16:9f:ab:e0:82
eth0 up
Virian MDC CFG Value ==> 4
: cfg1 0xf cfg2 0x7214
eth1: 40:16:9f:ab:e0:82
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
### main_loop entered: bootdelay=1

### main_loop: bootcmd="bootm 0x9f020000"
Autobooting in 1 seconds press tt to abort
AR7241#

And last commands in OpenOCD telnet:

> jtag_reset 1 0
> shutdown

jtag_reset 1 0      <= use this command, if you also use nTRST pin on JTAG cable. This command will disable nTRST line on JTAG adaptor.

Uboot for AP99 from tthrx      <= thx bro
https://forum.openwrt.org/viewtopic.php?id=33205


P.S.
Bootloader for the other boards need change so that it was loaded from SDRAM.

Or if someone wants to: you can make a universal u-boot - before applying specific configuration (while uboot is loading) of ap99, pb90, pb93, etc. theoretically, we could choose its configuration via the console by typing command. This is possible because UART (GPIO 9 and 10) - common for this CPUs.

4 (edited by Dioptimizer 2012-06-29 01:06:47)

Re: Debrick Routers with AR724x processors Using JTAG

Last wiki version

Re: Debrick Routers with AR724x processors Using JTAG

Alternative universal bootloader over JTAG (with flash size detection) - myloram.
Also there is another varian for AR71xx CPU's.

Re: Debrick Routers with AR724x processors Using JTAG

I have a totally bricked D-link DIR-615 H/W E3 with AR7240 CPU and MX25L3206  flash.

Already soldered a serial and jtag connector to the board, and I have also made a parallel Xilinx DLC5 cable.
Followed DIOPTIMIZER instructions, traced nTRST-TDI-TDO-TTMS-TCK lines from JTAG connector to CPU and discovered that some of them were interrupted by a missing resistors on board.....soldered jumpers instead of them.
Also created a manual reset button between +VCC (pin 14 on JTAG) and nTRST (used a 100 ohm resistor)
Connected a TTL to RS232 converter to serial (TX,RX,GND)....used Windows Hyperterminal , but getting nothing.

Should I be able to received something from serial port even if router's bootloader is probably dead ??

So far have not found any JTAG program , which would support AR7240 CPU and MX25L3206 flash !!
Does  the mentioned MYLORAM or MYLOADER or OPENOCD has support for these chips ?
Thanks

Re: Debrick Routers with AR724x processors Using JTAG

Sorry, but I'm going to have to resurrect the dead on this one.  I tried the above process on a WZR-HP-G300NH2 router running the AR7242 proc, but I haven't had much luck.  I tried variations of this as well.  Here's what I've tried in hopes that someone can help me figure out why this isn't working right.

Router: WZR-HP-G300NH2
Proc: AR7242-AH1A
JTAG Unit: USB JTAG NT
Originally sought help at: http://www.usbjtag.com/vbforum/showthread.php?s=eb39556ec2322b5b17be10b38b0fc29a&p=55639

try{
//On the back of the board, there's a blank space for a resistor (R309) which has one pad directly connected to pin 80 and the other pad is connected to ground.  I soldered a wire to the pad attached to pin 80.  I soldered the other end of the wire to a 35.7 Ohm resistor and the other end of the 35 Ohm resistor to a PBNO switch and the other end of the switch to the VCC on the serial port.  (Pin 1 - 3.3v)
}

catch:{
//USB JTAG NT reported "Debug Off" after following the steps to keep pin 80 hot while booting the unit and then releasing the switch after 2 seconds.
}



try{
//I removed the resistor and tried again to see if putting the full 3.3V through would fix the issue.  (I was reading 2.59V on my voltmeter with the resistor in.)
}

catch{
//That didn't work. It still said "Debug Off" on USB JTAG NT.  (Keep in mind that I know my USB JTAG NT is working properly and I did use it on other units successfully.  USBBDM (The guy who created USB JTAG NT) told me to use the settings for WRT160NL and that's what I've been using for this unit.  He referred me to this thread to try it out as well.
}



try{
//I tried hooking pin 80 directly to VCC and not releasing it.
}

catch{
//It still said "Debug Off."
}



try{
//I tried connecting pin 80 to the JTAG header's pin 1 (nTRST pin that's disconnected from the board - no circuitry connects to it) as USB JTAG NT keeps that line hot.
}

catch{
//USB JTAG NT's software reports "Debug Off."
}



I have yet to try out using pin 93 as the VCC source, but the only way I'd see that working is if it pulls enough voltage away from pin 93 that it goes low and pin 80 goes high from powering both pins, but my best guess is that they both would go low as you'd be splitting the power source at an original 3.3v.

Does anyone have any other ideas I can try with this unit?  Has anyone ever fondled it's JTAG port before?  lol

8 (edited by Dioptimizer 2013-07-13 00:20:49)

Re: Debrick Routers with AR724x processors Using JTAG

LightworkerNaven
What is your target to use JTAG on the device?

If you want to restore the flash memory, can easily connect to the flash memory (no Desoldering) via SPI programmator, and the processor to translate in RST mode (so all GPIO's will not be active - low state).

All my experiments were without datasheet, even now there is no way to find the datasheet for this processor (AR724x).
I even say more, I'm not sure that "nTRST" exists at all on processors ar7241/ar7242 (unlike ar7240).
The fact is that when we connect the power to the 80pin - it disables the flash memory on the device (if it is connected to this 80-pin=CS0-pin on flashchip) - the processor just not initialized and enabling the JTAG or may switches to Test/Debug Mode.

What does this "Debug Off."?
Do you have an extended response from the software?
What is the IDentifier of the processor is waiting for your software, if it is waiting for it at all?
Under that link confuses me a configuration file that contains the option availability of DMA in the JTAG - this is not true.
All operations with a processor only PrAcc mode.
Also option IRLength which should be "5" (have you seen the config. file for OpenOCD?)

jtag newtap $CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1

Sorry for my English is incredibly horrible.

Re: Debrick Routers with AR724x processors Using JTAG

USB JTAG NT is a proprietary program that I bought to JTAG my stuff with since it seems to be the most comprehensive of the ones I saw while researching.  It's easy to use and comes with a GUI.  The "Debug Off" bit is part of that program and also the DMA bit is part of what it reads from it's config.  DMA just means dynamic memory address and because it isn't starting at 0x0 usually, it's dynamic in terms of it's placement in the chip.  That's my take on why he added that.

As for using the JTAG port on the WZR-HP-G300NH2, I figured out how to make it work properly using this tutorial for the pinout and following the traces on the board to discover that several resistors were missing to interrupt the JTAG.  My findings can be found in this post which I'll keep updated until I'm done with the JTAG process.

http://www.usbjtag.com/vbforum/showthread.php?t=8570&page=2#21

By the way, thanks for the IR Length code.  I'll go and check into converting the config files you posted and modifying them to work with USB JTAG NT with my unit.

Re: Debrick Routers with AR724x processors Using JTAG

Is there anybody who connected to JTAG on D-Link DIR-615-E4 (AR7240 chip) successfully?

I'm soldered jumpers instead of missing resistors on the board, so all JTAG ping connected to AR7240 chip correctly (in accordance to info at first post).
I'm connected to the board via J-Link clone using openocd-0.7, but not success:

>openocd-0.7.0.exe -f interface\jlink.cfg -f target\ar71xx.cfg -c "adapter_khz 10"
Open On-Chip Debugger 0.7.0 (2013-05-05-10:41)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter_nsrst_delay: 100
jtag_ntrst_delay: 100
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
131072
adapter speed: 10 kHz
Info : J-Link initialization started / target CPU reset initiated
Info : J-Link compiled Dec 03 2007 17:15:31 ARM Rev.5
Info : J-Link caps 0xdffbf
Info : J-Link hw version 53000
Info : J-Link hw type J-Link
Info : J-Link max mem block 9992
Info : J-Link configuration
Info : USB-Address: 0xff
Info : Kickstart power on JTAG-pin 19: 0xffffffff
Info : Vref = 2.517 TCK = 1 TDI = 0 TDO = 0 TMS = 0 SRST = 0 TRST = 0
Info : J-Link JTAG Interface ready
Info : clock speed 10 kHz
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Error: ar71xx.cpu: IR capture error; saw 0x00 not 0x01
Warn : Bypassing JTAG setup events due to errors

Re: Debrick Routers with AR724x processors Using JTAG

I am doing some openocd tests over a wr841nd 7.2, mostly cache code related. Now this board is working fine
for me. The board is halted using the ntrst line from my ftdi hs adapter (self made). After deasserting the RST line there is around 15 to 20 ms time left to halt the core. Openocd at 500khz takes about 3 or 4ms to halt it. Setting adapter_khz below 50khz fails.
With additional hardware the core can be halted by blocking the clock at pin 94, the tap seems to work without clocking.
For memory dump from spi flash mips32 scan_delay must be set to 3600 or higher and the transfer speed is around 75Kbytes/s at 15000khz scan rate. For memory loads to ram scan_delay can be set to 0 and the transfer speed is over 600Kbytes/s (works with fast data transfer).
In case of fail in queued mode probably openocd refuses to work because pracc access don't starts at pracc text. The only option is a reset or if you want call the jtt utility ( in the config).
Use mips32 scan_delay 2000000 to jump back to legacy mode.
Use only the ftdi adapter driver. DO NOT USE ft2232!!!! if you have ftdi based adapter of course.
Wiggler works a bit faster in queued mode but not much, better let it in legacy mode (by default for every adapter).
Good luck an thanks for the code, my English is not better.

#################  config ######################

# Atheros AR724x MIPS 24Kc SoC.
# tested on AP99 refererence board
#
# this settings are taken from source of u-boot for this board
# (for PLL) file:    u-boot/board/ar7240/common/lowlevel_init.S
# (for DDR) file:    u-boot/cpu/mips/ar7240/meminit.c
#      with file:    u-boot/include/configs/ap99.h

# preliminary config based on https://forum.openwrt.org/viewtopic.php?id=34993
# tested on an ar7241-ah1a based board

if { [info exists CHIPNAME] } {
   set _CHIPNAME $CHIPNAME
} else {
   set _CHIPNAME AR7241
}

if { [info exists ENDIAN] } {
   set _ENDIAN $ENDIAN
} else {
   set _ENDIAN big
}

if { [info exists CPUTAPID] } {
   set _CPUTAPID $CPUTAPID
} else {
   set _CPUTAPID 0x00000001
}

jtag_ntrst_assert_width 200
jtag_ntrst_delay 1

reset_config trst_only

jtag newtap $_CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id $_CPUTAPID

set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME mips_m4k -endian $_ENDIAN -chain-position $_TARGETNAME


# setup working area somewhere in RAM
$_TARGETNAME configure -work-area-phys 0x80600000 -work-area-size 0x20000


$_TARGETNAME configure -event reset-init {
    global _TARGETNAME
    mips32 scan_delay 2000000        ;# do it in legacy mode

    mww 0xb8060008 3            ;# rst watchdog timer control
    irscan $_TARGETNAME 0xc            ;# ejtagboot indication, internal reset will be triggered

    # catch error, mww will fail after reset
    catch { mww 0xb806000c 0x12c }        ;# rst watchdog timer (resets SoC)

    echo "watchdog settings done"
    sleep 200
    halt

    mww 0xb8050000 0x00090828        ;# clr pll mask (rst: 02090828)
    mww 0xb8050000 0x00050828        ;# CPU:400 DDR:400 AHB:200
    mww 0xb8050000 0x00040828        ;# clr pll bypass

    #next command will reset for PLL changes to take effect

    mww 0xb8050008 2            ;# set reset_switch
    irscan $_TARGETNAME 0xc            ;# ejtagboot indication, internal reset will be triggered

    # catch error, really not needed in this case, in legacy mode  it reads a second pass through pracc text (like a normal exit)
    catch { mww 0xb8050008 3 }        ;# set clock_switch (resets SoC)

    echo "pll settings done"
    sleep 200
    halt

    mww 0xb8050008 0        ;# set reset_switch bit & clock_switch bit
   
    # Setup DDR config and flash mapping

    mww 0xb8000000 0xc7bc8cd0    ;# DDR cfg cdl val (rst: 77be8cd0)
    mww 0xb8000004 0x9dd0e6a8    ;# DDR cfg2 cdl val (rst: 99d10628)

    mww 0xb8000010 8        ;# force precharge all banks
    mww 0xb8000008 0x133        ;# DDR mode value init
    mww 0xb8000010 1        ;# force EMRS update cycle
    mww 0xb800000c 0        ;# clr ext. mode register

    mww 0xb8000010 2        ;# force auto refresh all banks
    mww 0xb8000010 8        ;# force precharge all banks
    mww 0xb8000008 0x33        ;# set DDR mode value CAS=3
    mww 0xb8000010 1        ;# force EMRS update cycle
    mww 0xb8000014 0x4f10        ;# DDR refresh value
    mww 0xb8000018 0xff        ;# DDR Read Data This Cycle value (16bit: 0xffff)
    mww 0xb800001c 2        ;# delay added to the DQS0 line (normal = 8)
    mww 0xb8000020 2        ;# delay added to the DQS1 line (normal = 9)
    mww 0xb8000024 0
    mww 0xb8000028 0

    irscan $_TARGETNAME 0xd        ;# normalboot

    echo ""
    echo "Targed initialized uncached"
}



# serial SPI capable flash
# flash bank <driver> <base> <size> <chip_width> <bus_width>

# Make a jump to text (0xff200200) utility
proc jtt {} {
    poll off
    sleep 50
    global _TARGETNAME
    irscan $_TARGETNAME 0x9            ;# select data register
    drscan $_TARGETNAME 32 0xbc80080    ;# Jump code
    irscan $_TARGETNAME 0xa            ;# select control register
    drscan $_TARGETNAME 32 0x8000c000    ;# finish processor access, go to next
    sleep 50
    irscan $_TARGETNAME 0x9
    drscan $_TARGETNAME 32 0        ;# Nop code, in delay slot of the jump
    irscan $_TARGETNAME 0xa
    drscan $_TARGETNAME 32 0x8000c000
    poll on
}
####################### end config #############################

12 (edited by Dioptimizer 2013-08-14 15:17:32)

Re: Debrick Routers with AR724x processors Using JTAG

sarroyo wrote:

...In case of fail in queued mode probably openocd refuses to work because pracc access don't starts at pracc text. The only option is a reset or if you want call the jtt utility ( in the config)....

Another my config file

OEM COMPEX WPE72(Atheros AR724x) config file (without resets SoC):

init-ar7240.mac wrote:

; macro file for AR7200 boards (32/64 MB ram)
; OCD Commander settings:
;     Target Processor: MIPS, EJTAG 2.5, 32 bit
;     Connection      : LPT1
;     OCD Device      : Wiggler
;     OCD Speed       : 380 KHz

reset
mipsendian big


; WAR for the bug#55574: Set the CKE (bit 7 in DDR_CONFIG2 register)
; to low initially
word 0xB8000004 = 0x99D10628


; set PLL
word 0xb8050000 = 0x00040828


; update PLL
word 0xb8050008 = 0x1
delay 10

word 0xb8050008 = 0x0

; disable flash remap
word 0xbf000004 = 0x43


; DDR

word 0xb8000000 = 0xC7BC8CD0
word 0xB8000004 = 0x9DD0E6A8
word 0xB8000010 = 0x00000008
word 0xB8000008 = 0x00000133
delay 10

word 0xB8000010 = 0x00000001
word 0xB800000C = 0x00000000
word 0xB8000010 = 0x00000002
word 0xB8000010 = 0x00000008
word 0xB8000008 = 0x00000033
word 0xB8000010 = 0x00000001

word 0xB8000014 = 0x00004F10
word 0xB8000018 = 0x000000FF

word 0xB800001C = 0x00000007
word 0xB8000020 = 0x00000007

;
; UART Test
;

word 0xB8040028 = 0x000480FA

word 0xB802000C = 0x00000083
word 0xB8020000 = 0x0000006D
word 0xB8020004 = 0x00000000
word 0xB802000C = 0x00000003
word 0xB8020008 = 0x00000001

word 0xB8020000 = 0x00000030
word 0xB8020000 = 0x00000031
word 0xB8020000 = 0x00000032
word 0xB8020000 = 0x00000033
word 0xB8020000 = 0x00000034
word 0xB8020000 = 0x00000035
word 0xB8020000 = 0x00000036
word 0xB8020000 = 0x00000037
word 0xB8020000 = 0x00000038
word 0xB8020000 = 0x00000039
word 0xB8020000 = 0x0000000D
word 0xB8020000 = 0x0000000A

; load file
delay 500
download myloram.srec

delay 100
go

http://wiki.openwrt.org/doc/techref/bootloader/myloader#myloram

sarroyo
If you can, please, put here your TEST with this(COMPEX) configuration file (also with a universal boot loader myloram) and place your results here.
Thanks anyway.

Re: Debrick Routers with AR724x processors Using JTAG

The new configuration for init works much better and is much simpler. Scan_delay can be set to 0 for memory dumps and  at 15000Khz in queued mode works up to 114kb/s. Contrary for memory writes to ram i need to add now a little delay of about 100, but still works over 600Kb/s.
Cache modes can be changed in config register and works without any other additional configuration, fine.
Seems the flash is working a bit faster.
The bad news is that myloram does not work me. Ping does not work at all  and i end making some stupidity and bricking my router. Here is part of the  log from the serial console:

Main Menu

1 - Load Firmware
2 - Load Program
3 - BIOS Setup
4 - Fdisk Utility
5 - Update Flash (Binary Mode)
6 - Update Firmware (Image Mode)
7 - Reboot System
8 - Memory Test

Please select : 3

BIOS Setup

1 - Device ID Setup
2 - Flash Setup
3 - DRAM Setup
4 - Boot Mode Setup
5 - TFTP Server Setup
6 - Ethernet Address Setup
7 - Load Default
8 - Ethernet Interface Setup

Please select : 1

Device ID Setup

Vendor ID (11f6) :

evice ID (0672) :
Subvendor ID (11f6) : 
Subdevice ID (0672) :
Revision (00000000) :
Update System Paramters ............. Done

BIOS Setup

1 - Device ID Setup
2 - Flash Setup
3 - DRAM Setup
4 - Boot Mode Setup
5 - TFTP Server Setup
6 - Ethernet Address Setup
7 - Load Default
8 - Ethernet Interface Setup

Please select : 3

DRAM Setup

DRAM Size (02000000) :
Update System Paramters ............. Done

BIOS Setup

1 - Device ID Setup
2 - Flash Setup
3 - DRAM Setup
4 - Boot Mode Setup
5 - TFTP Server Setup
6 - Ethernet Address Setup
7 - Load Default
8 - Ethernet Interface Setup

Please select : 4

Boot Mode Setup

1 - Load Firmware
2 - Load Program (HEX)
3 - Load Program (BIN)
4 - Load Program (ELF)
5 - Update Firmware
6 - Main Menu

Please Select 1

Update System Paramters ............. Done

BIOS Setup

1 - Device ID Setup
2 - Flash Setup
3 - DRAM Setup
4 - Boot Mode Setup
5 - TFTP Server Setup
6 - Ethernet Address Setup
7 - Load Default
8 - Ethernet Interface Setup

Please select : Exit

Main Menu

1 - Load Firmware
2 - Load Program
3 - BIOS Setup
4 - Fdisk Utility
5 - Update Flash (Binary Mode)
6 - Update Firmware (Image Mode)
7 - Reboot System
8 - Memory Test

Please select : 7

Reboot System
ÿ

U-Boot 1.1.4 (Sep  3 2010 - 12:35:51)

AP99 (ar7241 - Virian) U-boot
DRAM:
sri
ar7240_ddr_initial_config(133): virian ddr1 init
#### TAP VALUE 1 = 0xf, 2 = 0x10 [0x0: 0x1f]
32 MB
id read 0x100000ff
sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
Virian MDC CFG Value ==> 4
: cfg1 0xf cfg2 0x7014
eth0: 00:03:7f:09:0b:ad
eth0 up
Virian MDC CFG Value ==> 4
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...



OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel...
failed,
data error!

System halted!

#################################### end console log

Whit verify_image i found this diffs:
checksum mismatch - attempting binary compare
diff 0 address 0xbfc2f800. Was 0x20 instead of 0xea
diff 1 address 0xbfc2f801. Was 0x02 instead of 0x3b
diff 2 address 0xbfc2f802. Was 0x11 instead of 0x1b
diff 3 address 0xbfc2f803. Was 0x07 instead of 0x8c
diff 4 address 0xbfc2f804. Was 0x00 instead of 0x7d
diff 5 address 0xbfc2f805. Was 0x00 instead of 0x44
diff 6 address 0xbfc2f806. Was 0x00 instead of 0x8a
diff 7 address 0xbfc2f807. Was 0x00 instead of 0x88
diff 8 address 0xbfc2f808. Was 0x00 instead of 0xe6
diff 9 address 0xbfc2f809. Was 0x00 instead of 0x56
diff 10 address 0xbfc2f80a. Was 0x00 instead of 0xa2
diff 11 address 0xbfc2f80b. Was 0x00 instead of 0x47
diff 12 address 0xbfc2f80c. Was 0x00 instead of 0xf5
diff 13 address 0xbfc2f80d. Was 0x00 instead of 0x39
diff 14 address 0xbfc2f80e. Was 0x00 instead of 0x31
diff 15 address 0xbfc2f80f. Was 0x00 instead of 0x52
diff 16 address 0xbfc2f810. Was 0x11 instead of 0x35
diff 17 address 0xbfc2f811. Was 0xf6 instead of 0xaa
diff 18 address 0xbfc2f812. Was 0x06 instead of 0xe4
diff 19 address 0xbfc2f813. Was 0x72 instead of 0x41
diff 20 address 0xbfc2f814. Was 0x11 instead of 0xf6
diff 21 address 0xbfc2f815. Was 0xf6 instead of 0xad
diff 22 address 0xbfc2f816. Was 0x06 instead of 0x50
diff 23 address 0xbfc2f817. Was 0x72 instead of 0xf8
diff 24 address 0xbfc2f818. Was 0x00 instead of 0x7d
diff 25 address 0xbfc2f819. Was 0x00 instead of 0x08
diff 26 address 0xbfc2f81a. Was 0x00 instead of 0xff
diff 27 address 0xbfc2f81b. Was 0x00 instead of 0x1a
diff 28 address 0xbfc2f81c. Was 0x00 instead of 0x86
diff 29 address 0xbfc2f81d. Was 0x02 instead of 0xe5
diff 30 address 0xbfc2f81e. Was 0x00 instead of 0x71
diff 31 address 0xbfc2f81f. Was 0x00 instead of 0xc8
diff 32 address 0xbfc2f820. Was 0x00 instead of 0x3e
diff 33 address 0xbfc2f821. Was 0x00 instead of 0x30
diff 34 address 0xbfc2f822. Was 0x00 instead of 0x34
diff 35 address 0xbfc2f823. Was 0x02 instead of 0xbe
diff 36 address 0xbfc2f824. Was 0xc0 instead of 0xb5
diff 37 address 0xbfc2f825. Was 0xa8 instead of 0x0c
diff 38 address 0xbfc2f826. Was 0xa8 instead of 0x72
diff 39 address 0xbfc2f827. Was 0x01 instead of 0x82
diff 40 address 0xbfc2f828. Was 0x80 instead of 0x13
diff 41 address 0xbfc2f829. Was 0x00 instead of 0xa7
diff 42 address 0xbfc2f82a. Was 0x20 instead of 0x3a
diff 43 address 0xbfc2f82b. Was 0x00 instead of 0x57
diff 44 address 0xbfc2f82c. Was 0x00 instead of 0xe4
diff 45 address 0xbfc2f82d. Was 0x40 instead of 0x6a
diff 46 address 0xbfc2f82e. Was 0x00 instead of 0xa9
diff 47 address 0xbfc2f82f. Was 0x00 instead of 0x0a
diff 48 address 0xbfc2f830. Was 0x02 instead of 0x67
diff 49 address 0xbfc2f831. Was 0x00 instead of 0xf5
diff 50 address 0xbfc2f832. Was 0x00 instead of 0x86
diff 51 address 0xbfc2f833. Was 0x00 instead of 0x28
diff 52 address 0xbfc2f834. Was 0x01 instead of 0x16
diff 53 address 0xbfc2f835. Was 0x00 instead of 0x75
diff 54 address 0xbfc2f836. Was 0x00 instead of 0x4b
diff 55 address 0xbfc2f837. Was 0x00 instead of 0x3b
diff 56 address 0xbfc2f838. Was 0x10 instead of 0xf5
diff 57 address 0xbfc2f839. Was 0x43 instead of 0xa6
diff 58 address 0xbfc2f83a. Was 0x80 instead of 0xd2
diff 59 address 0xbfc2f83b. Was 0x12 instead of 0x2f
diff 60 address 0xbfc2f83c. Was 0x00 instead of 0x99
diff 61 address 0xbfc2f83d. Was 0x00 instead of 0x44
diff 62 address 0xbfc2f83e. Was 0x00 instead of 0x26
diff 63 address 0xbfc2f83f. Was 0x00 instead of 0xb5
diff 64 address 0xbfc2f840. Was 0x00 instead of 0xcb
diff 65 address 0xbfc2f841. Was 0x00 instead of 0x60
diff 66 address 0xbfc2f842. Was 0x00 instead of 0xc7
diff 67 address 0xbfc2f843. Was 0x00 instead of 0x70
diff 68 address 0xbfc2f844. Was 0x00 instead of 0x7b
diff 69 address 0xbfc2f845. Was 0x00 instead of 0xee
diff 70 address 0xbfc2f846. Was 0x00 instead of 0x26
diff 71 address 0xbfc2f847. Was 0x00 instead of 0x80
diff 72 address 0xbfc2f848. Was 0x00 instead of 0x09
diff 73 address 0xbfc2f849. Was 0x00 instead of 0xc3
diff 74 address 0xbfc2f84a. Was 0x00 instead of 0xba
diff 75 address 0xbfc2f84b. Was 0x00 instead of 0x54
diff 76 address 0xbfc2f84c. Was 0x00 instead of 0x03
diff 77 address 0xbfc2f84d. Was 0x00 instead of 0xa7
diff 78 address 0xbfc2f84e. Was 0x00 instead of 0xb6
diff 79 address 0xbfc2f84f. Was 0x00 instead of 0x59
diff 80 address 0xbfc2f850. Was 0x00 instead of 0x83
diff 81 address 0xbfc2f851. Was 0x00 instead of 0xa5
diff 82 address 0xbfc2f852. Was 0x00 instead of 0xed
diff 83 address 0xbfc2f853. Was 0x00 instead of 0x1e
No more differences found.

################################## end diffs

I tried to halt the bootlader to find  out a solution but no luck. So i end putting the flash code from u-boot in a file
added a main function, a Makefile, a linker script to load the code at 0xa0000000, solved all the dependencies, typedefs, etc.. and run the code in ram.
First to erase the sector at 0xbfc20000 ( i forgot to setup the stack pointer and the entry address for main() (not a 0xa0000000) ) and next another build to flash the bricked sector. Not easy but now is working again.

Thanks for the new config is much better.