Bricked goflex home --> Problem with JTAG

Hello,
I have a little problem with the flash of the uboot on a goflex home. I use OpenOCD + Buspirate.
Here is my log:

Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> init
> halt
target state: halted
target halted in Thumb state due to debug-request, current mode: Supervisor
cpsr: 0x400000f3 pc: 0xffff0ba6
MMU: enabled, D-Cache: enabled, I-Cache: enabled
> dockstar_init
> load_image uboot.kwb 0x800000
524288 bytes written at address 0x00800000
downloaded 524288 bytes in 593.318726s (0.863 KiB/s)
> resume 0x800200
target state: halted
target halted in ARM state due to debug-request, current mode: Undefined instruction
cpsr: 0x400000db pc: 0xffff0004
MMU: enabled, D-Cache: enabled, I-Cache: enabled
>

root@tobi-SAM-451B:~# openocd -f dockstar.cfg -c "init"
Open On-Chip Debugger 0.7.0-dev-00007-g1ab99c3 (2012-09-30-21:11)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.sourceforge.net/doc/doxygen/bugs.html
Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain
adapter_nsrst_delay: 200
jtag_ntrst_delay: 200
DEPRECATED! use 'adapter_khz' not 'jtag_khz'
adapter speed: 500 kHz
DEPRECATED! use 'adapter_nsrst_delay' not 'jtag_nsrst_delay'
adapter_nsrst_delay: 500
Warn : use 'feroceon.cpu' as target identifier, not '0'
dockstar_reset_cpu
Info : Buspirate Interface ready!
Info : Want to set speed to 500kHz, but not implemented yet
Error: Translation from jtag_speed to khz not implemented
Info : adapter-specific clock speed value 500
Info : JTAG tap: feroceon.cpu tap/device found: 0x20a023d3 (mfg: 0x1e9, part: 0x0a02, ver: 0x2)
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit
Info : accepting 'telnet' connection from 4444
target state: halted
target halted in Thumb state due to debug-request, current mode: Supervisor
cpsr: 0x400000f3 pc: 0xffff0ba6
MMU: enabled, D-Cache: enabled, I-Cache: enabled
524288 bytes written at address 0x00800000
downloaded 524288 bytes in 593.318726s (0.863 KiB/s)
target state: halted
target halted in ARM state due to debug-request, current mode: Undefined instruction
cpsr: 0x400000db pc: 0xffff0004
MMU: enabled, D-Cache: enabled, I-Cache: enabled

# Marvell SheevaPlug

interface buspirate
buspirate_port /dev/ttyUSB0
#source [find interface/buspirate.cfg]
source [find target/feroceon.cfg]
jtag_khz 500
jtag_nsrst_delay 500

$_TARGETNAME configure \
	-work-area-phys 0x100000 \
	-work-area-size 65536 \
	-work-area-backup 0

# Disabled for the dockstar	
#arm7_9 dcc_downloads enable

# this assumes the hardware default peripherals location before u-Boot moves it
set _FLASHNAME $_CHIPNAME.flash
nand device $_FLASHNAME orion 0 0xd8000000

proc dockstar_init { } {

	# We need to assert DBGRQ while holding nSRST down.
	# However DBGACK will be set only when nSRST is released.
	# Furthermore, the JTAG interface doesn't respond at all when
	# the CPU is in the WFI (wait for interrupts) state, so it is
	# possible that initial tap examination failed.  So let's
	# re-examine the target again here when nSRST is asserted which
	# should then succeed.
	jtag_reset 0 1
	feroceon.cpu arp_examine
	halt 0
	jtag_reset 0 0
	wait_halt

	arm mcr 15 0 0 1 0 0x00052078

	mww 0xD0001400 0x43000C30
	mww 0xD0001404 0x39543000 
	mww 0xD0001408 0x22125451 
	mww 0xD000140C 0x00000833 
	mww 0xD0001410 0x000000CC
	mww 0xD0001414 0x00000000 
	mww 0xD0001418 0x00000000
	mww 0xD000141C 0x00000C52 
	mww 0xD0001420 0x00000042 
	mww 0xD0001424 0x0000F17F 
	mww 0xD0001428 0x00085520 
	mww 0xD000147c 0x00008552 

	# 1st bank is 128 MB
	mww 0xD0001504 0x07FFFFF1 
	# 2nd bank of DRAM is not used
	mww 0xD0001508 0x00000000 
	mww 0xD000150C 0x00000000
	# Commented the 3 following	lines
	#mww 0xD0001504 0x0FFFFFF1 
	#mww 0xD0001508 0x10000000 
	#mww 0xD000150C 0x0FFFFFF5 
	mww 0xD0001514 0x00000000
	mww 0xD000151C 0x00000000
	mww 0xD0001494 0x003C0000 
	mww 0xD0001498 0x00000000
	mww 0xD000149C 0x0000F80F 
	mww 0xD0001480 0x00000001 
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000

	mww 0xD0010000 0x01111111 
	mww 0xD0010004 0x11113322 
	mww 0xD0010008 0x00001111

	mww 0xD0010418 0x003E07CF
	mww 0xD001041C 0x000F0F0F
	mww 0xD0010470 0x01C7D943

}

proc sheevaplug_reflash_uboot { } {

	# reflash the u-Boot binary and reboot into it
	sheevaplug_init
	nand probe 0
	nand erase 0 0x0 0xa0000
	nand write 0 uboot.bin 0 oob_softecc_kw
	resume

}

proc sheevaplug_reflash_uboot_env { } {

	# reflash the u-Boot environment variables area
	sheevaplug_init
	nand probe 0
	nand erase 0 0xa0000 0x40000
	nand write 0 uboot-env.bin 0xa0000 oob_softecc_kw
	resume

}

proc sheevaplug_load_uboot { } {

	# load u-Boot into RAM and execute it
	sheevaplug_init
	#load_image uboot.elf
	#verify_image uboot.elf
	load_image u-boot
	verify_image u-boot
	resume 0x00600000

}

proc dockstar_reset_cpu { } {

#	System and User mode registers
#		  r0: 00000000       r1: 00000000       r2: 00000000       r3: 00000000
#		  r4: 00000000       r5: 00000000       r6: 00000000       r7: 00000000
#		  r8: 00000000       r9: 00000000      r10: 00000000      r11: 00000000
#		 r12: 00000000   sp_usr: 7dddee86   lr_usr: dffebe46       pc: ffff0a42
#		cpsr: 400000f3

	reg r1 0
	reg r2 0
	reg r3 0
	reg r4 0
	reg r5 0
	reg r6 0
	reg r7 0
	reg r8 0
	reg r9 0
	reg r10 0
	reg r11 0
	reg r12 0
	reg sp_usr 0
	reg lr_usr 0
	reg pc 0
	# Set the CPU in Supervisor mode
	reg cpsr 0x13

#	FIQ mode shadow registers
#	  r8_fiq: fbcfff64   r9_fiq: d7dfafd6  r10_fiq: 1fff6d2e  r11_fiq: 1db65df4
#	 r12_fiq: ff5a6de4   sp_fiq: 745fe7d5   lr_fiq: 89f7ae3e spsr_fiq: 00000000

	reg r8_fiq 0
	reg r9_fiq 0
	reg r10_fiq 0
	reg r11_fiq 0
	reg r12_fiq 0
	reg sp_fiq 0
	reg lr_fiq 0
	reg spsr_fiq 0

#	Supervisor mode shadow registers
#	  sp_svc: fffeff84   lr_svc: ffff0a43 spsr_svc: 00000000

	reg sp_svc 0
	reg lr_svc 0
	reg spsr_svc 0

#	Abort mode shadow registers
#	  sp_abt: 51fe66f7   lr_abt: d7abaef7 spsr_abt: 00000000

	reg sp_abt 0
	reg lr_abt 0
	reg spsr_abt 0

#	IRQ mode shadow registers
#	  sp_irq: 7fdb4ed5   lr_irq: 6d41122e spsr_irq: 00000000

	reg sp_irq 0
	reg lr_irq 0
	reg spsr_irq 0
	
#	Undefined instruction mode shadow registers
#	  sp_und: 75ffef7e   lr_und: d75b6cd1 spsr_und: 00000000

	reg sp_und 0
	reg lr_und 0
	reg spsr_und 0
	
}

After the command "resume 0x800200" the goflex don´t boot the uboot :-(
The box shows no reaction. I try some different uboot´s. My Setup ist tested on a Dockstar and it works.
Does any one have an idea what i can try?

Sorry for my Bad English

greats
Tobi1337



Edited 2 time(s). Last edit at 10/01/2012 08:46AM by tobi1337.

root@tobi-SAM-451B:~# telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> init
> halt
target state: halted
target halted in Thumb state due to debug-request, current mode: Supervisor
cpsr: 0x400000f3 pc: 0xffff0ba6
MMU: enabled, D-Cache: enabled, I-Cache: enabled
> dockstar_init
> nand probe 0
unknown NAND flash device found, manufacturer id: 0x00 device id: 0x00
in procedure 'nand'
>

I have the command "nand probe 0" tried to what it can of the NAND are not recognized?

Wait a moment... maybe I'm forgetting something important here... but...

Isn't the entire GoFlex series capable of something easier than JTAG?

I was thinking that there is some sort of stub or microBIOS in ROM that will autoload a correctly formatted image...

via serial...

=======================

YES!!!

see here : http://forum.doozan.com/read.php?3,7852

=====================================================

• davy's Github Repo's rescue-dg

Edited 1 time(s). Last edit at 10/04/2012 06:48PM by davygravy.

davygravy Wrote:
-------------------------------------------------------
> Wait a moment... maybe I'm forgetting something
> important here... but...
>
> Isn't the entire GoFlex series capable of
> something easier than JTAG?
>
> I was thinking that there is some sort of stub or
> microBIOS in ROM that will autoload a correctly
> formatted image...
>
> via serial...
>
> =======================
>
> YES!!!
>
> see here : http://forum.doozan.com/read.php?3,7852

Thank you davygravy!!
You're the man! I drink to you a couple of good German beer! :)

If anyone is interested how I solved it.
Boot Goflex via uart ---> uboot write about tfptboot invite ---> flash uboot to nand
Without tfptboot it does not work, kwboot write the uboot to another area ;)

root@ubuntu:~/kwboot-tool# ./kwboot -t -B 115200 /dev/ttyUSB0 -b goflexhome.kwb -p
Sending boot message. Please reboot the target...\
Sending boot image...
  0 % [......................................................................]
  1 % [......................................................................]
  3 % [......................................................................]
           ..... 
 97 % [......................................................................]
 99 % [....................................]
[Type Ctrl-\ + c to quit]


U-Boot 2011.12 (Apr 18 2012 - 23:08:20)
Seagate GoFlexNet

SoC:   Kirkwood 88F6281_A1
DRAM:  128 MiB
WARNING: Caches not enabled
NAND:  256 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   egiga0
88E1116 Initialized on egiga0
Hit any key to stop autoboot:  0 
GoFlexNet               
GoFlexNet> 
GoFlexNet> setenv ipaddr 192.168.2.210         # Has to be in your network and unused
GoFlexNet> setenv serverip 192.168.2.36         # IP address of your TFTP server
GoFlexNet> setenv ethaddr 00:xx:xx:xx:xx:xx    # MAC address, written on the bottom of the case
GoFlexNet> saveenv
Saving Environment to NAND...
Erasing Nand...
Erasing at 0xc0000 -- 100% complete.
Writing to Nand... done
GoFlexNet> tftpboot 0x800000 goflexhome.kwb
Using egiga0 device
TFTP from server 192.168.2.36; our IP address is 192.168.2.210
Filename 'goflexhome.kwb'.
Load address: 0x800000
Loading: ####################################
done
Bytes transferred = 524288 (80000 hex)
GoFlexNet> nand erase 0x0 0x80000

NAND erase: device 0 offset 0x0, size 0x80000
Erasing at 0x60000 -- 100% complete.
OK
GoFlexNet> nand write.e 0x800000 0x0 0x80000

NAND write: device 0 offset 0x0, size 0x80000
 524288 bytes written: OK
GoFlexNet> reset

U-Boot 2011.12 (Apr 18 2012 - 23:08:20)
Seagate GoFlexNet

SoC:   Kirkwood 88F6281_A1
DRAM:  128 MiB
WARNING: Caches not enabled
NAND:  256 MiB
In:    serial
Out:   serial
Err:   serial
Net:   egiga0
88E1116 Initialized on egiga0
Hit any key to stop autoboot:  0 
GoFlexNet> 

I've been searching for posts relating to using JTAG with a bricked GoFlexHome and this is the only one which I can find. I've never used JTAG and don't know anything about it, but I'd to know how you go about connecting a Buspirate to a GoFlexHome base unit..

balanga Wrote:
-------------------------------------------------------
> I've been searching for posts relating to using
> JTAG with a bricked GoFlexHome and this is the
> only one which I can find. I've never used JTAG
> and don't know anything about it, but I'd to know
> how you go about connecting a Buspirate to a
> GoFlexHome base unit..


So this was not helping you to understand what JTAG is?
https://forum.doozan.com/read.php?3,44179,44654#msg-44654

Bus Pirate cable should be connected to the 20 pin JTAG header on the GFHome board.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I read your answer and mentioned that I didn't see anything like a 20 pin JTAG header on the GFHome board, but on a different forum someone mentioned that it may be possible to connect using the 10 pins where a USB/serial connector is connected.

This is what the GoFlexHome board looks like:-

https://images.anandtech.com/doci/3955/baseunitinside_575px.jpg

and there doesn't seem to be anything like a 20 pin JTAG header.

> and there doesn't seem to be anything like a 20
> pin JTAG header.

That's understandable. Sometime not all pins are populated, and the header is smaller with less number of pins.

And ususally, the header needs to be soldered into the board, where the pinouts solder points are. Boards such as iConnect comes with the header factory-installed.

Google it and you will find the image of the pintouts on the board (someone here could do that for you if you cannot find it).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I found this page:-

https://www.mikrocontroller.net/articles/GoFlexHome

which may well have all I need... but I don't understand German...

There is a section which seems to refer to the pinouts

UART-/JTAG-Stecker

Auf der Platine befindet sich eine 10-polige Stiftleiste im 2mm Rastermass (J1).

Die Belegung ist wahrscheinlich identisch zur Dockstar bzw. GoFlex Net, siehe auch: Dockstar#UART.2FJTAG-Stecker

Zumindest die Pins GND, UART TxD und UART RxD sind gleich:

  9  7  5  3  1
 10  8  6  4  2
       RX TX GND

Pin 1 ist auf der Platine mit einem kleine weißen Dreieck gekennzeichnet!

Am einfachsten man beschafft sich ein sog. "PL-2303 USB-to-Serial Port Adapter", z.B. ein Handy-Kabel, mehr dazu: UART auf USB

Informationen zum JTAG-Protokoll hier: JTAG

but I can't tell if a JTAG connecter can be wired up to those pins.