Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
| toh:tp-link:tl-mr3420:debrick.using.jtag [2018/05/31 18:18] – wikitext src piped thru google translate.. hopes! benryanau | toh:tp-link:tl-mr3420:debrick.using.jtag [2018/06/02 01:38] – link fixed tmomas | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | FIXME ** This page is not fully translated, yet. Please help completing the translation. ** \\ // (remove this paragraph once the translation is finished) // | + | ====== Example of repairing the router via JTAG (ar724x) |
| - | + | ||
| - | ===== Example of repairing the router via JTAG (ar724x) ===== | + | |
| ** Note: ** The list of routers on which the main configuration file for OpenOCD should work, in fact, can be much larger (almost all AR724x processors). However, for each platform ((Device with a specific architecture used by NOR / NAND / DDR memory, number of indicators, buttons, their attachment to GPIO numbers, etc. For example, here the platform is considered - AP99)), an appropriate loader, modified so that it can be downloaded from SDRAM memory - without loss of functionality. | ** Note: ** The list of routers on which the main configuration file for OpenOCD should work, in fact, can be much larger (almost all AR724x processors). However, for each platform ((Device with a specific architecture used by NOR / NAND / DDR memory, number of indicators, buttons, their attachment to GPIO numbers, etc. For example, here the platform is considered - AP99)), an appropriate loader, modified so that it can be downloaded from SDRAM memory - without loss of functionality. | ||
| - | ==== Hardware ==== | + | ===== Hardware |
| - | === JTAG on the processor === | + | ==== JTAG on the processor |
| -> [[docs: techref: hardware: port.jtag]] | -> [[docs: techref: hardware: port.jtag]] | ||
| The pinout of the [[http:// | The pinout of the [[http:// | ||
| ^ JTAG Common Name ^ AR724x Pin ^ Connector EJTAG for DIR-615 Ex ^ | ^ JTAG Common Name ^ AR724x Pin ^ Connector EJTAG for DIR-615 Ex ^ | ||
| - | | | <del> EJTAG_SEL </ del> // (do not use) // | 79 | {{: media: dlink: dir-615: e4-photos: d-link.dir-615e4-jtag.jpg? | + | | <del> EJTAG_SEL </ |
| - | | | ** TDI ** | 81 | ::: | | + | | ** TDI ** | 81 | ::: | |
| - | | | ** TDO ** | 82 | ::: | | + | | ** TDO ** | 82 | ::: | |
| - | | | ** TMS ** | 84 | ::: | | + | | ** TMS ** | 84 | ::: | |
| - | | | ** TCK ** | 85 | ::: | | + | | ** TCK ** | 85 | ::: | |
| - | | | <del> RST </ del> // (do not use) // | 93 | ::: | | + | | <del> RST </ |
| If there is no marking of the reference of the processor feet on the board, then one can use this orientation: | If there is no marking of the reference of the processor feet on the board, then one can use this orientation: | ||
| Line 23: | Line 21: | ||
| \\ | \\ | ||
| - | === Connecting to JTAG === | + | ==== Connecting to JTAG ==== |
| ** Note: ** Debugging and testing (for writing this instruction) was performed with a working loader, so it was necessary to temporarily disable the flash memory of the device (** CS0 ** => 3.3V), so that the device initialization and boot process was interrupted in the bootloader, there may be an instruction to disable the JTAG port to release the GPIO line). | ** Note: ** Debugging and testing (for writing this instruction) was performed with a working loader, so it was necessary to temporarily disable the flash memory of the device (** CS0 ** => 3.3V), so that the device initialization and boot process was interrupted in the bootloader, there may be an instruction to disable the JTAG port to release the GPIO line). | ||
| - | ** EJTAG_SEL ** pin - AR724 ** 0 ** / AR724 ** 1 ** / AR724 ** 2 ** Considering that EJTAG connector is not displayed on many devices - the logical state of this pin does not have a specific role for JTAG operation protocol. It's enough to interrupt the device boot from the flash memory, described in the above way. And if you consider that you are reading this manual - most likely, your device does not boot properly. | + | ** EJTAG_SEL ** pin - AR724**0**/ |
| - | ** RST ** pin - AR724 ** 0 ** / AR724 ** 1 ** / AR724 ** 2 ** completely resets the processor, i.e. including the recorded CPU initialization registers, this state is equivalent to disconnecting power from the device - therefore, we will not ** use this pin ** either. | + | ** RST ** pin - AR724**0**/ AR724**1**/ AR724**2** completely resets the processor, i.e. including the recorded CPU initialization registers, this state is equivalent to disconnecting power from the device - therefore, we will not ** use this pin ** either. |
| -> [[docs: techref: hardware: port.jtag.cables]] | -> [[docs: techref: hardware: port.jtag.cables]] | ||
| Line 36: | Line 34: | ||
| In the example presented in this section, the connection was made through the old and slow JTAG adapter for the LPT port - [[http:// | In the example presented in this section, the connection was made through the old and slow JTAG adapter for the LPT port - [[http:// | ||
| - | ==== The software part ==== | + | ===== The software part ===== |
| The program part contains a list of programs that will be needed during debugging and recovery through the JTAG interface. Also, this part contains a list of used OpenOCD commands and a configuration file for AR724x processors. | The program part contains a list of programs that will be needed during debugging and recovery through the JTAG interface. Also, this part contains a list of used OpenOCD commands and a configuration file for AR724x processors. | ||
| - | === Programs for working with JTAG === | + | ==== Programs for working with JTAG ==== |
| - | * ** OpenOCD ** ((If necessary, you can replace it with ** OCD Commander **, but remember that there is another format for sending registers to the processor, so the config file needs to be changed to this format.)) - [[http: // | + | * ** OpenOCD ** ((If necessary, you can replace it with ** OCD Commander **, but remember that there is another format for sending registers to the processor, so the config file needs to be changed to this format.)) - [[http:// |
| * ** PuTTY ** - '' | * ** PuTTY ** - '' | ||
| - | * ** [[# # init-ar7240.cfg | init-ar7240.cfg]] ** - config. file for the OpenOCD program and your device (config file, you need to copy it to the OpenOCD program folder as target / init-ar7240.cfg). | + | * ** [[# # init-ar7240.cfg | init-ar7240.cfg]] ** - config. file for the OpenOCD program and your device (config file, you need to copy it to the OpenOCD program folder as target / |
| * ** [[http:// | * ** [[http:// | ||
| - | | + | * ** backup.bin ** - a conditional bootloader or another piece of flash data that needs to be restored. |
| + | |||
| + | ==== The OpenOCD commands used ==== | ||
| + | |||
| + | < | ||
| + | //B In the example presented in this section, the command is used as - identification of the identifier and device status, not more. Usually, when this command is executed, the ** nSRST ** is activated, but in our case ** RST ** pin is not the same .// | ||
| + | |||
| + | \\ | ||
| + | |||
| + | < | ||
| + | // Put the processor into debugging mode (accepting commands) .// | ||
| + | |||
| + | \\ | ||
| + | |||
| + | < | ||
| + | // After executing this command, the script for this event (enclosed in braces) will be executed, which is in the config. file (sending commands to the processor) .// | ||
| + | |||
| + | \\ | ||
| + | |||
| + | < | ||
| + | dump_image <file name> <start address in memory area or flash drive> < | ||
| + | </ | ||
| + | // This command saves the dump ** from ** the device' | ||
| + | |||
| + | \\ | ||
| + | |||
| + | < | ||
| + | load_image <file name> <address in memory area only> <file format> | ||
| + | </ | ||
| + | // This command loads the ** file into ** the device memory. The command must be executed ** after ** initializing the processor and device memory. // | ||
| + | |||
| + | \\ | ||
| + | |||
| + | < | ||
| + | resume <address in memory area or flash drive> | ||
| + | </ | ||
| + | // This command starts the loader, analog ** go ** in uboot' | ||
| + | |||
| + | \\ | ||
| + | |||
| + | === init-ar7240.cfg === | ||
| + | < | ||
| + | # Atheros AR724x MIPS 24Kc SoC. | ||
| + | # tested on AP99 reference board | ||
| + | # | ||
| + | # configure file for AR7200 boards (32/64 MB ram) | ||
| + | # this settings format for OpenCD was changed / taken from source of settings for OCD Commander | ||
| + | # source: http:// | ||
| + | |||
| + | adapter_nsrst_delay 100 | ||
| + | jtag_ntrst_delay 100 | ||
| + | |||
| + | reset_config trst_only separate; # or use only " | ||
| + | |||
| + | set CHIPNAME ar724x | ||
| + | |||
| + | jtag newtap $ CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 1 | ||
| + | |||
| + | set TARGETNAME $ CHIPNAME.cpu | ||
| + | target create $ TARGETNAME mips_m4k -endian big -chain-position $ TARGETNAME | ||
| + | |||
| + | $ TARGETNAME configure -event reset-init { | ||
| + | # WAR for the bug # 55574: Set the CKE (bit 7 in DDR_CONFIG2 register) | ||
| + | # to low initially | ||
| + | mww 0xB8000004 0x99D10628 | ||
| + | |||
| + | # set PLL | ||
| + | mww 0xb8050000 0x00040828 | ||
| + | |||
| + | # update PLL | ||
| + | mww 0xb8050008 0x1 | ||
| + | sleep 10 | ||
| + | mww 0xb8050008 0x0 | ||
| + | # disable flash remap | ||
| + | mww 0xbf000004 0x43 | ||
| + | |||
| + | # DDR | ||
| + | mww 0xb8000000 0xC7BC8CD0 | ||
| + | mww 0xB8000004 0x9DD0E6A8 | ||
| + | mww 0xB8000010 0x00000008 | ||
| + | mww 0xB8000008 0x00000133 | ||
| + | sleep 10 | ||
| + | mww 0xB8000010 0x00000001 | ||
| + | mww 0xB800000C 0x00000000 | ||
| + | mww 0xB8000010 0x00000002 | ||
| + | mww 0xB8000010 0x00000008 | ||
| + | mww 0xB8000008 0x00000033 | ||
| + | mww 0xB8000010 0x00000001 | ||
| + | mww 0xB8000014 0x00004F10 | ||
| + | mww 0xB8000018 0x000000FF | ||
| + | mww 0xB800001C 0x00000007 | ||
| + | mww 0xB8000020 0x00000007 | ||
| + | |||
| + | # | ||
| + | # UART Test | ||
| + | # | ||
| + | mww 0xB8040028 0x000480FA | ||
| + | mww 0xB802000C 0x00000083 | ||
| + | mww 0xB8020000 0x0000006D | ||
| + | mww 0xB8020004 0x00000000 | ||
| + | mww 0xB802000C 0x00000003 | ||
| + | mww 0xB8020008 0x00000001 | ||
| + | mww 0xB8020000 0x00000030 | ||
| + | mww 0xB8020000 0x00000031 | ||
| + | mww 0xB8020000 0x00000032 | ||
| + | mww 0xB8020000 0x00000033 | ||
| + | mww 0xB8020000 0x00000034 | ||
| + | mww 0xB8020000 0x00000035 | ||
| + | mww 0xB8020000 0x00000036 | ||
| + | mww 0xB8020000 0x00000037 | ||
| + | mww 0xB8020000 0x00000038 | ||
| + | mww 0xB8020000 0x00000039 | ||
| + | mww 0xB8020000 0x0000000D | ||
| + | mww 0xB8020000 0x0000000A | ||
| + | } | ||
| + | |||
| + | # setup working area somewhere in RAM | ||
| + | $ TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000 | ||
| + | |||
| + | # serial SPI capable flash | ||
| + | # flash bank < | ||
| + | </ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | ===== Recovery example ===== | ||
| + | |||
| + | Restore the boot loader ** u-boot ** and ** art ** section, on the MR3220 (4M) router in the Windows operating system. If desired, in the same way, in addition, you can flash ** firmware ** image or the entire flash memory - ** fullflash **. | ||
| + | |||
| + | * Unpack the assembled version of " | ||
| + | |||
| + | * Move or copy from the folder '' | ||
| + | |||
| + | * Create the file '' | ||
| + | openocd-0.5.0.exe -f interface / parport.cfg -f target / init-ar7240.cfg | ||
| + | pause | ||
| + | </ | ||
| + | |||
| + | * Connect JTAG to the computer and ** disconnected ** the router. | ||
| + | |||
| + | * We connect the UART to the computer and ** the unplugged ** router, also follows from | ||
| + | * * Connect JTAG to the computer and ** disconnected ** the router. | ||
| + | |||
| + | * Connect the UART to the computer and ** the unplugged ** router, also open ** PuTTY ** (the program must be configured on the parallel port of your computer with the appropriate settings for your router). | ||
| + | |||
| + | ==== Working with the OpenOCD program ==== | ||
| + | |||
| + | * Run ** ar724x.bat **, almost immediately you can turn on the router, the goal is to find the identifier '' | ||
| + | D: \ Free \ OpenOCD \ 0.5.0> openocd-0.5.0.exe -f interface / parport.cfg -f target / init-ar7240.cfg | ||
| + | Open On-Chip Debugger 0.5.0 (2012-04-06-14: | ||
| + | Licensed under GNU GPL v2 | ||
| + | For bug reports, read | ||
| + | http:// | ||
| + | Warn: Adapter driver ' | ||
| + | Info: only one transport option; autoselect ' | ||
| + | parport port = 0x378 | ||
| + | 6000 kHz | ||
| + | adapter_nsrst_delay: | ||
| + | jtag_ntrst_delay: | ||
| + | none separate | ||
| + | 131072 | ||
| + | Info: clock speed 500 kHz | ||
| + | Info: JTAG tap: ar724x.cpu tap / device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0) | ||
| + | Info: accepting ' | ||
| + | </ | ||
| + | |||
| + | * If everything went well, you need to start the console '' | ||
| + | Open On-Chip Debugger | ||
| + | > | ||
| + | </ | ||
| + | * Then enter the commands: \\ \\ < | ||
| + | > reset | ||
| + | JTAG tap: ar724x.cpu tap / device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0) | ||
| + | > | ||
| + | </ | ||
| + | > halt | ||
| + | target state: halted | ||
| + | target halted in MIPS32 mode due to debug-request, | ||
| + | > | ||
| + | </ | ||
| + | > reset init | ||
| + | JTAG tap: ar724x.cpu tap / device found: 0x00000001 (mfg: 0x000, part: 0x0000, ver: 0x0) | ||
| + | target state: halted | ||
| + | target halted in MIPS32 mode due to debug-request, | ||
| + | > | ||
| + | </ | ||
| + | > load_image backup_uboot.bin 0x81000000 bin | ||
| + | 131072 bytes written at address 0x81000000 | ||
| + | downloaded 131072 bytes in 12.250000s (10.449 KiB / s) | ||
| + | > load_image backup_art.bin 0x81020000 bin | ||
| + | 65536 bytes written at address 0x81020000 | ||
| + | downloaded 65536 bytes in 5.440000s (11.765 KiB / s) | ||
| + | > load_image 8Muboot_RAM_version.bin 0x80000000 bin | ||
| + | 262144 bytes written at address 0x80000000 | ||
| + | downloaded 262144 bytes in 21.639999s (11.830 KiB / s) | ||
| + | > | ||
| + | </ | ||
| + | * To access the bootloader, you need to enter ** tt ** | ||
| + | * The IP address of the computer, at the same time, should be - 192.168.1.23 (or use the '' | ||
| + | * The following command will start the loader from the SDRAM area of the memory, simultaneously with this process, another console should be started ** PuTTY **, configured on the serial port: < | ||
| + | resume 0x80000000 | ||
| + | </ | ||
| + | |||
| + | ==== Work in the bootloader U-boot ==== | ||
| + | |||
| + | The final stage of recovery is via the U-boot bootloader. It is necessary to erase the working area of the flash memory, and then copy the previously recorded data to the flash memory of the device. \\ You can do this as follows: | ||
| + | < | ||
| + | AR7241 # erase 0x9f000000 + 0x20000 | ||
| + | Erase Flash from 0x9f000000 to 0x9f01ffff in Bank # 1 | ||
| + | First 0x0 last 0x1 sector size 0x10000 | ||
| + | Erased 2 sectors | ||
| + | AR7241 # | ||
| + | </ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | < | ||
| + | AR7241 # cp 0x81000000 0x9f000000 0x20000 | ||
| + | Copy to Flash ... write addr: 9f000000 | ||
| + | done | ||
| + | AR7241 # | ||
| + | </ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | < | ||
| + | AR7241 # erase 0x9f3F0000 + 0x10000 | ||
| + | Erase Flash from 0x9f3f0000 to 0x9f3fffff in Bank # 1 | ||
| + | First 0x3f last 0x3f sector size 0x10000 | ||
| + | Erased 1 sectors | ||
| + | AR7241 # | ||
| + | </ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | < | ||
| + | AR7241 # cp 0x81020000 0x9f3F0000 0x10000 | ||
| + | Copy to Flash ... write addr: 9f3f0000 | ||
| + | done | ||
| + | AR7241 # | ||
| + | </ | ||
| + | |||
| + | |||
| + | The loader for SDRAM and the source code can be found in the [[https:// | ||
| + | |||
| + | Extended logs for working with the program and the material used can be found at [[https:// | ||
| + | |||
| + | ===== More Information ===== | ||
| + | |||
| + | Universal loader [[docs: | ||