DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2007-11-19 22:55:28

omissam1972
New member
Registered: 2007-11-19
Posts: 2

flashing bootloader in the marvell feroceon 88f5181

hello,
I have damaged the bootloader of mine wnr854t, with chip marvell feroceon 88f5181.
Now, i am using wiggler cable (buffered) a + openocd for re-flashing, the problem is that continuous to receive errors.

Where mistake?

thanks

file ---> openocd.cfg

#daemon configuration
telnet_port 4444
gdb_port 3333

#interface
interface parport
parport_port 0x378
parport_cable wiggler
#parport_cable old_amt_wiggler
jtag_speed 1
#use combined on interfaces or targets that can't set TRST/SRST separately
#reset_config trst_and_srst srst_pulls_trst
#reset_config trst_only
#reset_config trst_and_srst combined
reset_config srst_only

#jtag scan chain
#format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE)
jtag_device 4 0x1 0xf 0xe

jtag_nsrst_delay 1200
jtag_ntrst_delay 1200

#target configuration
daemon_startup reset

#target <type> <endianness> <startup mode> <chainpos> <variant>
target arm926ejs little run_and_halt 0 arm926ejs
run_and_halt_time 0 500

# planing with flash code - work in progress
working_area 0 0x00400000 0x40000 nobackup

#          driver   addr       size     chip_width  bus_width  options
flash bank cfi      0xff800000 0x400000 1           2          0

script ---> command

root@massimo-desktop:/opt/openocd/trunk/src# telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> halt
requesting target halt...
> flash write_binary 0 uboot.bin 0x0
failed writing file uboot.bin to flash bank 0 at offset 0x00000000
can't work with this flash while target is running
wrote  458884 byte from file uboot.bin to flash bank 0 at offset 0x00000000 in 0s 1956us (229104.757797 kb/s)
>

file ---> log.txt   ( openocd -d3 -l log.txt -f openocd.cfg )

Debug:   arm926ejs.c:703 arm926ejs_target_command(): chain_pos: 0, variant: arm926ejs
Debug:   jtag.c:1407 jtag_init(): -
Debug:   parport.c:400 parport_init(): requesting privileges for parallel port 0x378...
Debug:   parport.c:410 parport_init(): ...privileges granted
Debug:   parport.c:234 parport_reset(): trst: 0, srst: 0
Debug:   jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted
Debug:   jtag.c:1197 jtag_reset_callback(): -
Debug:   jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted
Debug:   jtag.c:1197 jtag_reset_callback(): -
Debug:   jtag.c:1291 jtag_examine_chain(): JTAG device found: 0x07926041 (Manufacturer: 0x020, Part: 0x7926, Version: 0x0
Debug:   jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted
Debug:   jtag.c:1197 jtag_reset_callback(): -
Debug:   openocd.c:113 main(): jtag init complete
Debug:   embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug:   jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST released
Debug:   jtag.c:1197 jtag_reset_callback(): -
Error:   embeddedice.c:181 embeddedice_build_reg_cache(): unknown EmbeddedICE version (comms ctrl: 0x00000018)
Debug:   arm7_9_common.c:707 arm7_9_assert_reset(): target->state: unknown
Debug:   jtag.c:295 jtag_call_event_callbacks(): jtag event: SRST asserted
Debug:   jtag.c:1197 jtag_reset_callback(): -
Debug:   jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST asserted
Debug:   jtag.c:1197 jtag_reset_callback(): -
Debug:   jtag.c:295 jtag_call_event_callbacks(): jtag event: SRST asserted
Debug:   jtag.c:1197 jtag_reset_callback(): -
Debug:   parport.c:234 parport_reset(): trst: 0, srst: 1
Debug:   parport.c:234 parport_reset(): trst: 0, srst: 1
Debug:   arm7_9_common.c:773 arm7_9_deassert_reset(): target->state: reset
Debug:   jtag.c:295 jtag_call_event_callbacks(): jtag event: SRST released
Debug:   jtag.c:1197 jtag_reset_callback(): -
Debug:   parport.c:234 parport_reset(): trst: 0, srst: 0
Debug:   openocd.c:117 main(): target init complete
Debug:   openocd.c:121 main(): flash init complete
Debug:   openocd.c:125 main(): NAND init complete
Debug:   openocd.c:129 main(): pld init complete
Debug:   gdb_server.c:1526 gdb_init(): gdb service for target arm926ejs at port 3333
Debug:   embeddedice.c:220 embeddedice_read_reg_w_check(): 1
Debug:   jtag.c:295 jtag_call_event_callbacks(): jtag event: TRST released
Debug:   jtag.c:1197 jtag_reset_callback(): -
Debug:   arm7_9_common.c:929 arm7_9_halt(): target->state: running
Debug:   embeddedice.c:384 embeddedice_write_reg(): 0: 0x00000002
Debug:   embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug:   embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug:   embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug:   embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug:   embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug:   embeddedice.c:220 embeddedice_read_reg_w_check(): 4
Debug:   embeddedice.c:220 embeddedice_read_reg_w_check(): 4

Offline

 

#2 2008-01-08 05:17:57

magore
Member
Registered: 2007-01-05
Posts: 25

Re: flashing bootloader in the marvell feroceon 88f5181

using the patched openocd code you need to run the command
flash probe 0
(you should see)
flash 'cfi' found at 0xff800000

> flash protect_check 0
successfully checked protect state
> flash info 0         
#1: cfi at 0xff800000, size 0x00800000, buswidth 1, chipwidth 1
        #0: 0x00000000 (0x2000kB) erase state unknown, not protected
        #1: 0x00002000 (0x2000kB) erase state unknown, not protected
        #2: 0x00004000 (0x2000kB) erase state unknown, not protected
        #3: 0x00006000 (0x2000kB) erase state unknown, not protected
        #4: 0x00008000 (0x2000kB) erase state unknown, not protected
        #5: 0x0000a000 (0x2000kB) erase state unknown, not protected
        #6: 0x0000c000 (0x2000kB) erase state unknown, not protected
        #7: 0x0000e000 (0x2000kB) erase state unknown, not protected
        #8: 0x00010000 (0x10000kB) erase state unknown, not protected
        #9: 0x00020000 (0x10000kB) erase state unknown, not protected
        #10: 0x00030000 (0x10000kB) erase state unknown, not protected
        #11: 0x00040000 (0x10000kB) erase state unknown, not protected
        #12: 0x00050000 (0x10000kB) erase state unknown, not protected
        #13: 0x00060000 (0x10000kB) erase state unknown, not protected
        #14: 0x00070000 (0x10000kB) erase state unknown, not protected
        #15: 0x00080000 (0x10000kB) erase state unknown, not protected
        #16: 0x00090000 (0x10000kB) erase state unknown, not protected
        #17: 0x000a0000 (0x10000kB) erase state unknown, not protected
        #18: 0x000b0000 (0x10000kB) erase state unknown, not protected
        #19: 0x000c0000 (0x10000kB) erase state unknown, not protected
        #20: 0x000d0000 (0x10000kB) erase state unknown, not protected
        #21: 0x000e0000 (0x10000kB) erase state unknown, not protected
        #22: 0x000f0000 (0x10000kB) erase state unknown, not protected
        #23: 0x00100000 (0x10000kB) erase state unknown, not protected
        #24: 0x00110000 (0x10000kB) erase state unknown, not protected
        #25: 0x00120000 (0x10000kB) erase state unknown, not protected
        #26: 0x00130000 (0x10000kB) erase state unknown, not protected
        #27: 0x00140000 (0x10000kB) erase state unknown, not protected
        #28: 0x00150000 (0x10000kB) erase state unknown, not protected
        #29: 0x00160000 (0x10000kB) erase state unknown, not protected
        #30: 0x00170000 (0x10000kB) erase state unknown, not protected
        #31: 0x00180000 (0x10000kB) erase state unknown, not protected
        #32: 0x00190000 (0x10000kB) erase state unknown, not protected
        #33: 0x001a0000 (0x10000kB) erase state unknown, not protected
        #34: 0x001b0000 (0x10000kB) erase state unknown, not protected
        #35: 0x001c0000 (0x10000kB) erase state unknown, not protected
        #36: 0x001d0000 (0x10000kB) erase state unknown, not protected
        #37: 0x001e0000 (0x10000kB) erase state unknown, not protected
        #38: 0x001f0000 (0x10000kB) erase state unknown, not protected
        #39: 0x00200000 (0x10000kB) erase state unknown, not protected
        #40: 0x00210000 (0x10000kB) erase state unknown, not protected
        #41: 0x00220000 (0x10000kB) erase state unknown, not protected
        #42: 0x00230000 (0x10000kB) erase state unknown, not protected
        #43: 0x00240000 (0x10000kB) erase state unknown, not protected
        #44: 0x00250000 (0x10000kB) erase state unknown, not protected
        #45: 0x00260000 (0x10000kB) erase state unknown, not protected
        #46: 0x00270000 (0x10000kB) erase state unknown, not protected
        #47: 0x00280000 (0x10000kB) erase state unknown, not protected
        #48: 0x00290000 (0x10000kB) erase state unknown, not protected
        #49: 0x002a0000 (0x10000kB) erase state unknown, not protected
        #50: 0x002b0000 (0x10000kB) erase state unknown, not protected
        #51: 0x002c0000 (0x10000kB) erase state unknown, not protected
        #52: 0x002d0000 (0x10000kB) erase state unknown, not protected
        #53: 0x002e0000 (0x10000kB) erase state unknown, not protected
        #54: 0x002f0000 (0x10000kB) erase state unknown, not protected
        #55: 0x00300000 (0x10000kB) erase state unknown, not protected
        #56: 0x00310000 (0x10000kB) erase state unknown, not protected
        #57: 0x00320000 (0x10000kB) erase state unknown, not protected
        #58: 0x00330000 (0x10000kB) erase state unknown, not protected
        #59: 0x00340000 (0x10000kB) erase state unknown, not protected
        #60: 0x00350000 (0x10000kB) erase state unknown, not protected
        #61: 0x00360000 (0x10000kB) erase state unknown, not protected
        #62: 0x00370000 (0x10000kB) erase state unknown, not protected
        #63: 0x00380000 (0x10000kB) erase state unknown, not protected
        #64: 0x00390000 (0x10000kB) erase state unknown, not protected
        #65: 0x003a0000 (0x10000kB) erase state unknown, not protected
        #66: 0x003b0000 (0x10000kB) erase state unknown, not protected
        #67: 0x003c0000 (0x10000kB) erase state unknown, not protected
        #68: 0x003d0000 (0x10000kB) erase state unknown, not protected
        #69: 0x003e0000 (0x10000kB) erase state unknown, not protected
        #70: 0x003f0000 (0x10000kB) erase state unknown, not protected
        #71: 0x00400000 (0x10000kB) erase state unknown, not protected
        #72: 0x00410000 (0x10000kB) erase state unknown, not protected
        #73: 0x00420000 (0x10000kB) erase state unknown, not protected
        #74: 0x00430000 (0x10000kB) erase state unknown, not protected
        #75: 0x00440000 (0x10000kB) erase state unknown, not protected
        #76: 0x00450000 (0x10000kB) erase state unknown, not protected
        #77: 0x00460000 (0x10000kB) erase state unknown, not protected
        #78: 0x00470000 (0x10000kB) erase state unknown, not protected
        #79: 0x00480000 (0x10000kB) erase state unknown, not protected
        #80: 0x00490000 (0x10000kB) erase state unknown, not protected
        #81: 0x004a0000 (0x10000kB) erase state unknown, not protected
        #82: 0x004b0000 (0x10000kB) erase state unknown, not protected
        #83: 0x004c0000 (0x10000kB) erase state unknown, not protected
        #84: 0x004d0000 (0x10000kB) erase state unknown, not protected
        #85: 0x004e0000 (0x10000kB) erase state unknown, not protected
        #86: 0x004f0000 (0x10000kB) erase state unknown, not protected
        #87: 0x00500000 (0x10000kB) erase state unknown, not protected
        #88: 0x00510000 (0x10000kB) erase state unknown, not protected
        #89: 0x00520000 (0x10000kB) erase state unknown, not protected
        #90: 0x00530000 (0x10000kB) erase state unknown, not protected
        #91: 0x00540000 (0x10000kB) erase state unknown, not protected
        #92: 0x00550000 (0x10000kB) erase state unknown, not protected
        #93: 0x00560000 (0x10000kB) erase state unknown, not protected
        #94: 0x00570000 (0x10000kB) erase state unknown, not protected
        #95: 0x00580000 (0x10000kB) erase state unknown, not protected
        #96: 0x00590000 (0x10000kB) erase state unknown, not protected
        #97: 0x005a0000 (0x10000kB) erase state unknown, not protected
        #98: 0x005b0000 (0x10000kB) erase state unknown, not protected
        #99: 0x005c0000 (0x10000kB) erase state unknown, not protected
        #100: 0x005d0000 (0x10000kB) erase state unknown, not protected
        #101: 0x005e0000 (0x10000kB) erase state unknown, not protected
        #102: 0x005f0000 (0x10000kB) erase state unknown, not protected
        #103: 0x00600000 (0x10000kB) erase state unknown, not protected
        #104: 0x00610000 (0x10000kB) erase state unknown, not protected
        #105: 0x00620000 (0x10000kB) erase state unknown, not protected
        #106: 0x00630000 (0x10000kB) erase state unknown, not protected
        #107: 0x00640000 (0x10000kB) erase state unknown, not protected
        #108: 0x00650000 (0x10000kB) erase state unknown, not protected
        #109: 0x00660000 (0x10000kB) erase state unknown, not protected
        #110: 0x00670000 (0x10000kB) erase state unknown, not protected
        #111: 0x00680000 (0x10000kB) erase state unknown, not protected
        #112: 0x00690000 (0x10000kB) erase state unknown, not protected
        #113: 0x006a0000 (0x10000kB) erase state unknown, not protected
        #114: 0x006b0000 (0x10000kB) erase state unknown, not protected
        #115: 0x006c0000 (0x10000kB) erase state unknown, not protected
        #116: 0x006d0000 (0x10000kB) erase state unknown, not protected
        #117: 0x006e0000 (0x10000kB) erase state unknown, not protected
        #118: 0x006f0000 (0x10000kB) erase state unknown, not protected
        #119: 0x00700000 (0x10000kB) erase state unknown, not protected
        #120: 0x00710000 (0x10000kB) erase state unknown, not protected
        #121: 0x00720000 (0x10000kB) erase state unknown, not protected
        #122: 0x00730000 (0x10000kB) erase state unknown, not protected
        #123: 0x00740000 (0x10000kB) erase state unknown, not protected
        #124: 0x00750000 (0x10000kB) erase state unknown, not protected
        #125: 0x00760000 (0x10000kB) erase state unknown, not protected
        #126: 0x00770000 (0x10000kB) erase state unknown, not protected
        #127: 0x00780000 (0x10000kB) erase state unknown, not protected
        #128: 0x00790000 (0x10000kB) erase state unknown, not protected
        #129: 0x007a0000 (0x10000kB) erase state unknown, not protected
        #130: 0x007b0000 (0x10000kB) erase state unknown, not protected
        #131: 0x007c0000 (0x10000kB) erase state unknown, not protected
        #132: 0x007d0000 (0x10000kB) erase state unknown, not protected
        #133: 0x007e0000 (0x10000kB) erase state unknown, not protected
        #134: 0x007f0000 (0x10000kB) erase state unknown, not protected

cfi information:

mfr: 0x0001, id:0x0001
qry: 'QRY', pri_id: 0x0002, pri_addr: 0x0040, alt_id: 0x0000, alt_addr: 0x0000
Vcc min: 2.7, Vcc max: 3.6, Vpp min: 0.0, Vpp max: 0.0
typ. word write timeout: 128, typ. buf write timeout: 128, typ. block erase timeout: 1024, typ. chip erase timeout: 1
max. word write timeout: 256, max. buf write timeout: 4096, max. block erase timeout: 16384, max. chip erase timeout: 1
size: 0x800000, interface desc: 2, max buffer write size: 5

Spansion primary algorithm extend information:
pri: 'PRI', version: 1.3
Silicon Rev.: 0x2, Address Sensitive unlock: 0x0
Erase Suspend: 0x2, Sector Protect: 0x1
VppMin: 11.5, VppMax: 12.5

Last edited by magore (2008-02-20 05:47:05)

Offline

 

#3 2008-02-27 23:33:06

omissam1972
New member
Registered: 2007-11-19
Posts: 2

Re: flashing bootloader in the marvell feroceon 88f5181

hi,
thanks for the interest. In previous log files of U-Boot:
Marvell>> flinfo
Bank # 1: INTEL 28F640J3A (64 Mbit)
Size: 8 MB,Bus Width: 2, device Width: 2.
Flash base: 0xff800000,Number of Sectors: 64 Type: REGULAR.


therefore in the rows of openocd.cfg I have inserted:
#target <type> <endianness> <startup mode> <chainpos> <variant>
target feroceon little reset_init 0
#          driver   addr       size     chip_width  bus_width  options
flash bank cfi      0xff800000 0x800000 2           2          0


Now executing the command:
> flash protect_check 0
value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f
in_handler reported a failed check

... ....

value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f
in_handler reported a failed check
value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f
in_handler reported a failed check
JTAG error while reading cpsr
auto_probe failed -900

Syntax error:
       protect_check    check protection state of sectors in flash bank <num>
>   


but it is possible to restore U-Boot?

thanks

Last edited by omissam1972 (2008-02-27 23:35:11)

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB