[OpenOCD-devel] MIPS ejtag DMA support

[Jeroen P. <jer...@ho...>]

Dears,

I have been working on OpenOCD support for the bcm3349 chipset, found in the motorola sb5101 cable modem. I want to be able to use it to flash different firmware to the device. I have succesfully managed to detect the bcm3349 chipset type using a bus pirate as programmer, but up til now the flash memory is not detected correctly.

    > scan_chain
       TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
    -- ------------------- -------- ---------- ---------- ----- ----- ------
     0 bcm3349.cpu            Y     0x0334917f 0x0334917f     5 0x01  0x03

The flash chip is an Intel TE28F160 that, according to the datasheet ( http://pdf.chinaicmart.com/88889/44107.pdf ), supports CFI. I found the flash start address in the config file of Tom's Jtag Utility, which is commonly used to flash this modem. The size of the chip is 8MB (check http://www.mail-archive.com/ope...@li.../msg04173/jtagkey.cfg config file where this chip is used), which I declared it as follows


    flash bank cfi 0x9fc00000 0x200000 2 2 0


When executing flash probe 0, I get the following error (read abort).

    Flash Manufacturer/Device: 0x00ff 0x00ff
    Could not probe bank: no QRY
    Try workaround w/0x555 instead of 0x55 to get QRY.
    Could not probe bank: no QRY
    auto_probe failed
    in procedure 'flash'


When analyszing the logs, I found that openOCD is using the prAcc access method to read and write. Other flash utilities read and write to the flash memory with DMA, for which support was implemented in openOCD a while ago. DMA should be triggered according to the present IMPCODE of the board, which is 00800904 in this case (which means ejtag 1 or 2 according to the code). For some reason, it seems that the impcode is not detected correctly, which makes the code fall back to the prAcc access method.

Also, I can't find any clue in the debug messages on the IMPCODE detection.

   * Does anybody have an idea how I can trigger DMA access to the flash memory? Is there a configuration option I can add in the attached cfg to enable it? Currently I am using mips_m4k as a target. I searched the documentation extensively but coiuldn't find anything else relevant.
   * How can I trigger the reset-init procedure by default when calling using the attached cfg file?


In attachment you can find the config file (might not be compliant yet with openOCD standards) and the config file I used as reference to port it.

Thanks,

Jeroen.