Difference between revisions of "Sandbox"
m |
|||
(11 intermediate revisions by 3 users not shown) | |||
Line 37: | Line 37: | ||
==Feeds== | ==Feeds== | ||
+ | * [[Image:TSLive.jpg]] | ||
+ | * [[Image:TS-HTGL_mainboard_front.jpg]] | ||
+ | * [[Image:NAS_OSXSCmount1.png]] | ||
+ | * [[Image:NAS_OSXSGmount3.png]] | ||
+ | * [[Image:NAS_sharedFolder.png]] | ||
+ | * [[Image:NAS_updateROM.png]] | ||
+ | * [[Image:SharedFolder.png]] | ||
+ | * [[Image:NAS_OSXSGmount1.png]] | ||
+ | * [[Image:NAS_inputPasswd.png]] | ||
+ | * [[Image:Terrastation_mainboard_back.jpg]] | ||
+ | * [[Image:Terrastation_mainboard_front.jpg]] | ||
+ | * [[Image:TeraStation.jpg]] | ||
+ | * [[Image:Ts-pro-1.jpg]] | ||
+ | * [[Image:TerastationProMotherboard2.jpg]] | ||
+ | * [[Image:TerastationProMotherboard1.jpg]] | ||
+ | * [[Image:IMG_1457.JPG]] | ||
+ | * [[Image:IMG_1458.JPG]] | ||
+ | * [[Image:TSpro-mainboard-small.jpg]] | ||
+ | * [[Image:Impressum.png]] | ||
+ | * [[Image:Somerights20.gif]] | ||
+ | * [[Image:Mainboard-small.jpg]] | ||
+ | * [[Image:Serial_port_hacked.jpg]] | ||
+ | * [[Image:Serial_port_orig.jpg]] | ||
==<small>footer</small>== | ==<small>footer</small>== | ||
Line 318: | Line 341: | ||
* http://downloads.nas-central.org/openlink/powerpc-hdhlan-openlink-0.73b.zip | * http://downloads.nas-central.org/openlink/powerpc-hdhlan-openlink-0.73b.zip | ||
** In [[SlimServer server software that powers audio players from SlimDevices]] on 2007-09-11 20:39:07, 404 Not Found | ** In [[SlimServer server software that powers audio players from SlimDevices]] on 2007-09-11 20:39:07, 404 Not Found | ||
+ | |||
+ | |||
+ | =JTAG for the LS Pro and LS Live= | ||
+ | |||
+ | ==Background== | ||
+ | Tampakuro/kuroguy discovered the layout of the JTAG Port on an LS Pro v1 and an early KuroPro by tracing the wiring. The account of his work and other early efforts is here : [http://forum.nas-central.org/viewtopic.php?f=39&t=3001 JTAG for the LS Pro and LS Live]. He found that the v1 had a non-standard pinout. The v2 LS Live has a [http://hri.sourceforge.net/tools/jtag_faq_org.html#_Toc63218717 standard ARM 20 pin layout]. mdfirefighter and others discovered that Dominic Rath's OpenOCD software was the key to opening the LS Pro to JTAG - this is detailed in the same thread linked to above. At these early stages, OpenOCD did not offer any support for the Feroceon processor that our boxes run on, but instead we got by on a close relative, the ARM926EJS. | ||
+ | Recent developments include some built-in support for the Feroceon in OpenOCD (revision 315 and later). | ||
+ | |||
+ | ==Why use JTAG?== | ||
+ | *JTAG provides low-level access to a flash chip. This is necessary if you need to fix a serious UBoot problem on your LinkStation. | ||
+ | *It gives direct access to the processor (probably on useful for developers). | ||
+ | *If you are developing a new bootloader, it gives you the freedom to experiment without having to worry about bricking your box. | ||
+ | |||
+ | ==When not to use it== | ||
+ | JTAG access is more invasive than attaching a serial connector. It should not be your first choice if: | ||
+ | *you are trying to recover from flashing a v1 UBoot to your v2 LS Pro (just use a serial connection for this, use the LS Updater while in EM) | ||
+ | *you are looking for something cool to do (sane people, even developers, have been known to really break things while playing around) | ||
+ | |||
+ | ===Required Hardware,Software & Preparation=== | ||
+ | ====DISCLAIMER=== | ||
+ | <font color=red size=large> '''CAUTION : USE AT YOUR OWN RISK. IT IS POSSIBLE TO BRICK ONE'S BOX WITH THESE METHODS. UNBRICKING IS NOT GUARANTEED. YOU HAVE BEEN WARNED.''' These directions have been tested and checked on a LSProV2. YMMV.</font> | ||
+ | |||
+ | ====Hardware==== | ||
+ | *An LS Pro (or LS Live, though it hasn't been tested on the Live yet) | ||
+ | *JTAG headers already attached to your ARM-based LinkStation's board (see [ Add a JTAG Port] for details - you may want to consider low profile headers) | ||
+ | *JTAG adapter like the Olimex ARM-USB-TINY (tested) or a Wiggler (Wigglers and other paraport adapters reportedly work, but seem slower than USB) | ||
+ | *an x86 desktop/laptop running Linux (tested w/ Ubuntu 7.10) | ||
+ | |||
+ | ====Getting, Compiling and Configuring OpenOCD==== | ||
+ | The OCD software we use is [http://openfacts.berlios.de/index-en.phtml?title=Open_On-Chip_Debugger OpenOCD], created by Dominic Rath. You basically have two options here: | ||
+ | *Build it from svn for the Feroceon support and the latest (perhaps bleeding edge) features, or | ||
+ | *build it from the pre-Feroceon source, [http://downloads.nas-central.org/ALL_LS_KB_ARM9/openocd-lspro.tgz available for download from here]. Note that the config file in this package, found in docs/configs/lsp_wig.cfg is already set up and tested with parallel port interfaces, like for the Wiggler. | ||
+ | |||
+ | |||
+ | *Compiling: See [http://openfacts.berlios.de/index-en.phtml?title=Building_OpenOCD Building OpenOCD] for full details. The directions are listed below for using it with the Olimex JTAG USB TINY adapter, which is ftdi-based. Read the INSTALL file for details on building it for parallel port Wiggler devices. | ||
+ | **Install libftdi (http://www.intra2net.com/opensource/ftdi/) or libftd2xx (http://www.ftdichip.com/Drivers/D2XX.htm). Most accounts seem to indicate that more users have better luck with libftdi (which is available as a package for Ubuntu, for instance.) | ||
+ | **Build and install OpenOCD. Download it from the downloads on our site, or from svn at the OpenOCD site. For svn revision 335, a trivial patch was necessary (see patch). Then bootstrap, configure, make and make install. | ||
+ | ./bootstrap | ||
+ | ./configure --enable-ft2232_libftdi | ||
+ | make | ||
+ | make install | ||
+ | Also, '''if you are using libftdi''', you may have to add the following line to your /etc/fstab: | ||
+ | none /proc/bus/usb usbfs defaults,devmode=0666 0 0 | ||
+ | |||
+ | If you are using a parallel port Wiggler, you should read the literature and docs in the source, as they will guide you on what to do in terms of configuring before building. | ||
+ | |||
+ | |||
+ | *Configuring OpenOCD - Again, see [http://openfacts.berlios.de/index-en.phtml?title=OpenOCD_configuration Configuring OpenOCD] for details. Hints below show a config file that was used to flash a LS Pro V2 using OpenOCD svn revision 335, with an Olimex ARM-USB-TINY unit. (Note:The config file in the openocd-package in the downloads section is set up for parallel port Wiggler devices.) | ||
+ | # daemon config | ||
+ | telnet_port 4444 | ||
+ | gdb_port 3333 | ||
+ | daemon_startup attach | ||
+ | |||
+ | |||
+ | # interface | ||
+ | jtag_speed 0 | ||
+ | interface ft2232 | ||
+ | ft2232_layout "olimex-jtag" | ||
+ | ft2232_vid_pid 0x15ba 0x0004 | ||
+ | |||
+ | # use combined on interfaces or targets that can't set TRST/SRST separately | ||
+ | reset_config srst_only | ||
+ | #reset_config trst_and_srst | ||
+ | |||
+ | |||
+ | # jtag scan chain | ||
+ | #format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE) | ||
+ | jtag_device 4 0x1 0xf 0xe | ||
+ | |||
+ | #jtag_nsrst_delay 500 | ||
+ | #jtag_ntrst_delay 500 | ||
+ | |||
+ | |||
+ | # target configuration | ||
+ | # target <type> <endianess> <reset_mode> | ||
+ | # if chain_pos is not zero it seg faults | ||
+ | #target arm926ejs little reset_init 0 | ||
+ | target feroceon little reset_init 0 | ||
+ | run_and_halt_time 0 30 | ||
+ | #working_area 0 0xc8010000 0x400 nobackup | ||
+ | |||
+ | # flash configuration | ||
+ | # flash bank <driver> <base> <size> <chip_width> <bus_width> [driver_options ...] | ||
+ | flash bank cfi 0xfffc0000 0x00040000 1 1 0 jedec_probe | ||
+ | |||
+ | |||
+ | |||
+ | ====Flashing U-Boot to Your LS Pro==== | ||
+ | Read through these directions completely and rehearse them for maximum success. | ||
+ | 0. '''Required Software and Equipment, connected and/or ready.''' Attach the JTAG cable/connector to the header on your LS Pro while it is powered off. Have OpenOCD already compiled and your configuration file set up and checked. | ||
+ | |||
+ | '''1. Have two open windows/terminals with commands all ready to execute some commands.''' | ||
+ | *In one terminal window, cd to the directory where your config file is located. We'll call this the ''OpenOCD Window'' from here on out. As root, type in the command | ||
+ | openocd -f lsp_wig.cfg | ||
+ | '''but do not press enter yet'''. The filename lsp_wig.cfg is just an example and should be changed to whatever your config file is. | ||
+ | *In a second terminal window (called the ''Daemon Window'' from here on out), cd to where ever your image file for UBoot is. Then, as root, type the command | ||
+ | telnet localhost 4444 | ||
+ | '''but do not press enter yet'''. Note that the Daemon Window is where all of your commands will be entered and executed through. | ||
+ | |||
+ | '''2. Press & hold the reset button, and press the power button on your ARM-based LinkStation.''' If you do this right, it will make a musical tone 1 or 2 seconds after pressing the power button. | ||
+ | |||
+ | '''3. Start openocd and connect to daemon''' by pressing enter in the OpenOCD Window, and then in the Daemon Window. You will see the following in those two windows, respectively: | ||
+ | root@bytebaker-i686:/home/davygravy/Desktop/configs# openocd -f lsp_wig.cfg | ||
+ | Info: openocd.c:86 main(): Open On-Chip Debugger (2007-04-26 16:40 CEST) | ||
+ | Error: embeddedice.c:190 embeddedice_build_reg_cache(): unknown EmbeddedICE version (comms ctrl: 0x00000018) | ||
+ | The error seems commonplace to most of us that have used it. Until we know otherwise, most of us are assuming it is not a huge problem. | ||
+ | OpenOCD is now running. In the Daemon Window you will see something similar to this: | ||
+ | root@bitbaker-i686:/usr/src# telnet localhost 4444 | ||
+ | Trying 127.0.0.1... | ||
+ | Connected to localhost. | ||
+ | Escape character is '^]'. | ||
+ | |||
+ | '''4. Quickly halt your processor''' by entering one of these commands in the Daemon Window: | ||
+ | halt | ||
+ | reset | ||
+ | soft_reset_halt | ||
+ | You may have to go through the entire list. In any case, the processor must be halted (and maybe reset performed) in order to get flash access. You will see something like this as output in the Daemon Window: | ||
+ | > halt | ||
+ | requesting target halt... | ||
+ | > Target 0 halted | ||
+ | target halted in ARM state due to debug request, current mode: Abort | ||
+ | cpsr: 0x600000d7 pc: 0x00000028 | ||
+ | MMU: disabled, D-Cache: disabled, I-Cache: enabled | ||
+ | or if your processor is in some state where it needs more convincing, you may see something like this: | ||
+ | > halt | ||
+ | requesting target halt... | ||
+ | waiting for target halted... | ||
+ | timed out while waiting for target halted | ||
+ | timed out while waiting for target halted | ||
+ | > reset | ||
+ | > soft_reset_halt | ||
+ | requesting target halt and executing a soft reset | ||
+ | value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f | ||
+ | in_handler reported a failed check | ||
+ | Target 0 halted | ||
+ | target state: halted | ||
+ | target halted in ARM state due to debug request, current mode: Supervisor | ||
+ | cpsr: 0x000000d3 pc: 0x00000000 | ||
+ | MMU: disabled, D-Cache: disabled, I-Cache: disabled | ||
+ | This is a stage which has proven to be unpredictably difficult. You may have to wait more than 10 seconds to get a confirmation on a halt, and you may have to repeat it. Again, no flash access is possible without a halted processor. | ||
+ | |||
+ | '''5. Verify and probe your flash bank''' by executing the following commands: | ||
+ | flash banks | ||
+ | flash probe 0 | ||
+ | The 'flash banks' may be omitted - it is optional. The output will look similar to this: | ||
+ | > flash banks | ||
+ | #0: cfi at 0xfffc0000, size 0x00040000, buswidth 1, chipwidth 1 | ||
+ | > flash probe 0 | ||
+ | flash 'cfi' found at 0xfffc0000 | ||
+ | Once this is done, you have verified that you have proper access to the flash. | ||
+ | |||
+ | '''6. Erase flash bank and check erasure.''' Do not interrupt the process. Execute the following: | ||
+ | flash erase 0 0 63 | ||
+ | flash erase_check 0 | ||
+ | The output will look similar to this: | ||
+ | > flash erase 0 0 63 | ||
+ | erased sectors 0 through 63 on flash bank 0 in 4s 484466us | ||
+ | > flash erase_check 0 | ||
+ | successfully checked erase state | ||
+ | |||
+ | |||
+ | '''7. Write the UBoot image to flash.''' This may take anywhere from about an hour up to 5 or 6 hours. Do not interrupt the process. Execute the following: | ||
+ | flash write 0 lspstock052207.bin 0xfffc0000 | ||
+ | The file to be used as an image for flash should be changed to fit your situation (the one shown is for a LS Pro V1). | ||
+ | > flash write 0 /usr/src/openocd-package/doc/configs/lspstock052207.bin 0xfffc0000 | ||
+ | wrote file /usr/src/openocd-package/doc/configs/lspstock052207.bin to flash bank 0 at offset 0xfffc0000 in 12107s 811284us | ||
+ | |||
+ | |||
+ | '''8. To check to see if your flashing was successful''' (that the file you wanted to write to flash was actually written), dump it out: | ||
+ | dump_image currentcontents.bin 0xfffc0000 0x40000 | ||
+ | and then in a third terminal window, compare or diff them: | ||
+ | diff currentcontents.bin lspstock052207.bin | ||
+ | The second command should return nothing if the flash contents are identical to the image file. If the contents are the same as the image file, then you have successfully flashed the ROM with that image file. If it was a valid UBoot image, then it ''should'' boot up if there is a valid OS on the hdd and the UBoot env vars are correctly set. | ||
+ | |||
+ | '''9. Power down and restart.''' This is the moment of truth. Power down the LS by either holding the power button (safest) or unplugging it. Now restart. A serial cable attachment will be your friend here as it will give an indication of success: | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | ====Reference, Notes and Special Situations==== | ||
+ | #For a look at development of OpenOCD, see the [https://lists.berlios.de/pipermail/openocd-development/ OpenOCD Development List Archives] | ||
+ | #A [http://forum.sparkfun.com/viewforum.php?f=18 forum for OpenOCD users] is hosted by SparkFun - great for posting problems and searching for answers. | ||
+ | #Be aware that as of svn r332, Feroceon (not a true ARM926) is still not officially supported by OpenOCD. Success is not guaranteed...at least a handful of us have flashed once or twice, and then been able to proceed with a third flash. Presumably, the processor was in a state that allowed us to do the first flash(es) but for some unknown reason comes to be in some less manageable state. The difficulty for some of us has been getting the processor halted. | ||
+ | #OpenOCD svn revision 335 with a small patch gave success for me, after I patched the source (acknowledgement to bbradley for the patch). In src/target/feroceon.c, find these lines: | ||
+ | /* asserting DBGRQ won't win over the undef exception */ | ||
+ | arm7_9->use_dbgrq = 0 ; | ||
+ | change the 0 to 1: | ||
+ | /* asserting DBGRQ won't win over the undef exception */ | ||
+ | arm7_9->use_dbgrq = 1 ; | ||
+ | and then compile normally. Note that the 'halt' command didn't work, nor did reset. The only way to get it halted was to do a soft_reset_halt and simultaneously connect pins (RTCK) and (sRST) long enough to get it to halt. ('''Do this at your own risk.''') | ||
+ | root@bytebaker-i686:/home/davygravy# telnet localhost 4444 | ||
+ | Trying 127.0.0.1... | ||
+ | Connected to localhost. | ||
+ | Escape character is '^]'. | ||
+ | Open On-Chip Debugger | ||
+ | > halt | ||
+ | requesting target halt... | ||
+ | waiting for target halted... | ||
+ | timed out while waiting for target halted | ||
+ | timed out while waiting for target halted | ||
+ | > reset | ||
+ | > soft_reset_halt | ||
+ | requesting target halt and executing a soft reset | ||
+ | value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f | ||
+ | in_handler reported a failed check | ||
+ | |||
+ | ... | ||
+ | |||
+ | value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f | ||
+ | in_handler reported a failed check | ||
+ | Target 0 halted | ||
+ | target state: halted | ||
+ | target halted in ARM state due to debug request, current mode: Supervisor | ||
+ | cpsr: 0x000000d3 pc: 0x00000000 | ||
+ | MMU: disabled, D-Cache: disabled, I-Cache: disabled | ||
+ | > flash probe 0 | ||
+ | probing failed for flash bank '#0' at 0xfffc0000 | ||
+ | > flash probe 0 | ||
+ | flash 'cfi' found at 0xfffc0000 | ||
+ | > flash probe 0 | ||
+ | flash 'cfi' found at 0xfffc0000 | ||
+ | > flash erase 0 0 63 | ||
+ | erased sectors 0 through 63 on flash bank 0 in 2.822007s | ||
+ | > flash erase_check 0 | ||
+ | not enough working area available(requested 20, free 0) | ||
+ | no working area available, falling back to slow memory reads | ||
+ | successfully checked erase state | ||
+ | > flash write 0 /home/davygravy/Desktop/configs/lspro-v2flash.bin 0xfffc0000 | ||
+ | not enough working area available(requested 96, free 0) | ||
+ | no working area available, can't do block memory writes | ||
+ | Programming at fff80000, count 00040000 bytes remaining | ||
+ | Programming at fff80100, count 0003ff00 bytes remaining | ||
+ | Programming at fff80200, count 0003fe00 bytes remaining | ||
+ | |||
+ | ... | ||
+ | |||
+ | Programming at fffbfc00, count 00000400 bytes remaining | ||
+ | Programming at fffbfd00, count 00000300 bytes remaining | ||
+ | Programming at fffbfe00, count 00000200 bytes remaining | ||
+ | Programming at fffbff00, count 00000100 bytes remaining | ||
+ | Fixup 1 unaligned tail bytes | ||
+ | wrote 262144 byte from file /home/davygravy/Desktop/configs/lspro-v2flash.bin to flash bank 0 at offset 0xfffc0000 in 6522.530762s (0.039249 kb/s) | ||
+ | > dump_image currentcontents.bin 0xfffc0000 0x40000 | ||
+ | dumped 262144 byte in 18.345442s | ||
+ | > exit | ||
+ | Connection closed by foreign host. | ||
+ | root@bytebaker-i686:/home/davygravy# | ||
+ | |||
+ | |||
+ | |||
+ | ====Flash structure==== | ||
+ | For the LSProV2, here is the output of flinfo while in u-boot: | ||
+ | Marvell>> flinfo | ||
+ | |||
+ | Bank # 1: SST SST39VF020 (2 Mbit) | ||
+ | Size: 256 kB,Bus Width: 1, device Width: 1. | ||
+ | Flash base: 0xfffc0000,Number of Sectors: 64 Type: REGULAR. | ||
+ | Sector Start Addresses: | ||
+ | 00000000 (RO) 00001000 (RO) 00002000 (RO) 00003000 (RO) 00004000 (RO) | ||
+ | 00005000 (RO) 00006000 (RO) 00007000 (RO) 00008000 (RO) 00009000 (RO) | ||
+ | 0000a000 (RO) 0000b000 (RO) 0000c000 (RO) 0000d000 (RO) 0000e000 (RO) | ||
+ | 0000f000 (RO) 00010000 (RO) 00011000 (RO) 00012000 (RO) 00013000 (RO) | ||
+ | 00014000 (RO) 00015000 (RO) 00016000 (RO) 00017000 (RO) 00018000 (RO) | ||
+ | 00019000 (RO) 0001a000 (RO) 0001b000 (RO) 0001c000 (RO) 0001d000 (RO) | ||
+ | 0001e000 (RO) 0001f000 (RO) 00020000 (RO) 00021000 (RO) 00022000 (RO) | ||
+ | 00023000 (RO) 00024000 (RO) 00025000 (RO) 00026000 (RO) 00027000 (RO) | ||
+ | 00028000 (RO) 00029000 (RO) 0002a000 (RO) 0002b000 (RO) 0002c000 (RO) | ||
+ | 0002d000 (RO) 0002e000 (RO) 0002f000 (RO) 00030000 (RO) 00031000 (RO) | ||
+ | 00032000 (RO) 00033000 (RO) 00034000 (RO) 00035000 (RO) 00036000 (RO) | ||
+ | 00037000 (RO) 00038000 (RO) 00039000 (RO) 0003a000 (RO) 0003b000 (RO) | ||
+ | 0003c000 (RO) 0003d000 (RO) 0003e000 (RO) 0003f000 | ||
+ | |||
+ | *Available Commands in OpenOCD - Listed for reference. While working in the telnet daemon window w/ OpenOCD, entering the command '''help''' will yield a list of available commands and summary of help. | ||
+ | > help | ||
+ | help display this help | ||
+ | sleep sleep for <n> milliseconds | ||
+ | version show OpenOCD version | ||
+ | shutdown shut the server down | ||
+ | exit exit telnet session | ||
+ | log_output redirect logging to <file> (default: stderr) | ||
+ | debug_level adjust debug level <0-3> | ||
+ | jtag_speed set jtag speed (if supported) <speed> | ||
+ | scan_chain print current scan chain configuration | ||
+ | endstate finish JTAG operations in <tap_state> | ||
+ | jtag_reset toggle reset lines <trst> <srst> | ||
+ | runtest move to Run-Test/Idle, and execute <num_cycles> | ||
+ | statemove move to current endstate or [tap_state] | ||
+ | irscan execute IR scan <device> <instr> [dev2] [instr2] ... | ||
+ | drscan execute DR scan <device> <var> [ dev2 ] [var2] ... | ||
+ | verify_ircapture verify value captured during Capture-IR <enable|disable> | ||
+ | var allocate, display or delete variable <name> [num_fields|"del"] [size1] ... | ||
+ | field display/modify variable field <var> <field> [value|"flip"] | ||
+ | script execute commands from <file> | ||
+ | xsvf run xsvf <file> | ||
+ | targets no help available | ||
+ | flash no help available | ||
+ | banks - list configured flash banks | ||
+ | info - print info about flash bank <num> | ||
+ | probe - identify flash bank <num> | ||
+ | erase_check - check erase state of sectors in flash bank <num> | ||
+ | protect_check - check protection state of sectors in flash bank <num> | ||
+ | erase - erase sectors at <bank> <first> <last> | ||
+ | write - write binary <bank> <file> <offset> | ||
+ | protect - set protection of sectors at <bank> <first> <last> <on|off> | ||
+ | nand no help available | ||
+ | pld programmable logic device commands | ||
+ | arm7_9 arm7/9 specific commands | ||
+ | write_xpsr - write program status register <value> <not cpsr|spsr> | ||
+ | write_xpsr_im8 - write program status register <8bit immediate> <rotate> <not cpsr|spsr> | ||
+ | write_core_reg - write core register <num> <mode> <value> | ||
+ | sw_bkpts - support for software breakpoints <enable|disable> | ||
+ | force_hw_bkpts - use hardware breakpoints for all breakpoints (disables sw breakpoint support) <enable|disable> | ||
+ | dbgrq - use EmbeddedICE dbgrq instead of breakpoint for target halt requests <enable|disable> | ||
+ | fast_writes - (deprecated, see: arm7_9 fast_memory_access) | ||
+ | fast_memory_access - use fast memory accesses instead of slower but potentially unsafe slow accesses <enable|disable> | ||
+ | dcc_downloads - use DCC downloads for larger memory writes <enable|disable> | ||
+ | etb_dump - dump current ETB content | ||
+ | armv4_5 armv4/5 specific commands | ||
+ | reg - display ARM core registers | ||
+ | core_state - display/change ARM core state <arm|thumb> | ||
+ | disassemble - disassemble instructions <address> <count> ["thumb"] | ||
+ | arm9tdmi arm9tdmi specific commands | ||
+ | vector_catch - catch arm920t vectors ["all"|"none"|"<vec1 vec2 ...>"] | ||
+ | arm926ejs arm926ejs specific commands | ||
+ | cp15 - display/modify cp15 register <opcode_1> <opcode_2> <CRn> <CRm> [value] | ||
+ | cache_info - display information about target caches | ||
+ | virt2phys - translate va to pa <va> | ||
+ | mdw_phys - display memory words <physical addr> [count] | ||
+ | mdh_phys - display memory half-words <physical addr> [count] | ||
+ | mdb_phys - display memory bytes <physical addr> [count] | ||
+ | mww_phys - write memory word <physical addr> <value> | ||
+ | mwh_phys - write memory half-word <physical addr> <value> | ||
+ | mwb_phys - write memory byte <physical addr> <value> | ||
+ | cfi no help available | ||
+ | reg no help available | ||
+ | poll poll target state | ||
+ | wait_halt wait for target halt [time (s)] | ||
+ | halt halt target | ||
+ | resume resume target [addr] | ||
+ | step step one instruction | ||
+ | reset reset target [run|halt|init|run_and_halt|run_and_init] | ||
+ | soft_reset_halt halt the target and do a soft reset | ||
+ | mdw display memory words <addr> [count] | ||
+ | mdh display memory half-words <addr> [count] | ||
+ | mdb display memory bytes <addr> [count] | ||
+ | mww write memory word <addr> <value> | ||
+ | mwh write memory half-word <addr> <value> | ||
+ | mwb write memory byte <addr> <value> | ||
+ | bp set breakpoint <address> <length> [hw] | ||
+ | rbp remove breakpoint <adress> | ||
+ | wp set watchpoint <address> <length> <r/w/a> [value] [mask] | ||
+ | rwp remove watchpoint <adress> | ||
+ | load_image load_image <file> <address> ["bin"|"ihex"] | ||
+ | dump_image dump_image <file> <address> <size> | ||
+ | load_binary [DEPRECATED] load_binary <file> <address> | ||
+ | dump_binary [DEPRECATED] dump_binary <file> <address> <size> |
Latest revision as of 01:49, 14 December 2009
Contents
Help with editing
Additional Banner
Links to other NAS hacking communities |
Feeds
Broken Links
- In Apache and Secure Remote Access (SSL) to Network Shares (MIPSel) on 2007-09-11 20:36:20, Socket Error: 'Name or service not known'
- http://centericq.de/install.php (archive)
- In Centericq on 2007-09-11 20:36:38, 404 Not Found
- http://downloads.nas-central.org/patches/
- In Build additional kernel modules on 2007-09-11 20:36:25, 404 Not Found
- http://centericq.de/archive/source/releases/centericq-4.21.0.tar.gz (archive)
- In Centericq on 2007-09-11 20:36:38, 404 Not Found
- http://zd1211.ath.cx/wiki/DriverRewrite (archive)
- http://downloads.nas-central.org/uploads/ebox/libnet-cups-perl_0.37-1_powerpc.deb
- In EBox on FreeLink-Debian on 2007-09-11 20:36:41, 404 Not Found
- http://downloads.nas-central.org/uploads/ebox/libreadonly-xs-perl_1.04-1_powerpc.deb
- In EBox on FreeLink-Debian on 2007-09-11 20:36:41, 404 Not Found
EM
- http://downloads.nas-central.org/flash_development/PPC/telnet_and_ftp_enabled_ramdisks/
- In EM Mode on 2007-09-11 20:36:43, 404 Not Found
- http://downloads.nas-central.org/mirrors/yahoogroups-linkstationgeneralfiles/Cool%20and%20Quiet/
- In Fan noise on 2007-09-11 20:36:50, 404 Not Found
- http://download.nas-central.org/freelink/freelink_powerpc-hdhlan-1.11.zip
- In Freelink - Convert the LinkStation into a Full-fledged Debian Linux Server on 2007-09-11 20:36:55, Socket Error: 'Name or service not known'
- http://download.nas-central.org/freelink/freelink_mipsel-hdhlan-060810.zip
- In Freelink - Convert the LinkStation into a Full-fledged Debian Linux Server on 2007-09-11 20:36:55, Socket Error: 'Name or service not known'
- http://download.nas-central.org/freelink/freelink_powerpc-hdhglan-1.11.zip
- In Freelink - Convert the LinkStation into a Full-fledged Debian Linux Server on 2007-09-11 20:36:55, Socket Error: 'Name or service not known'
- http://downloads.nas-central.org/packages/ppc/libpng-1.2.12_ppc.tar.gz
- In GD Graphic Library (PowerPC) on 2007-09-11 20:36:55, 404 Not Found
- http://downloads.nas-central.org/packages/ppc/libjpeg_ppc.tar.gz
- In GD Graphic Library (PowerPC) on 2007-09-11 20:36:56, 404 Not Found
- http://downloads.nas-central.org/packages/ppc/gd-2.0.33_ppc.tar.gz
- In GD Graphic Library (PowerPC) on 2007-09-11 20:36:56, 404 Not Found
- http://www.infineon.com/cgi-bin/ifx/portal/ep/channelView.do?channelId=-65129&channelPage=/ep/channel/productOverview.jsp&pageTypeId=17099
- In Ethernet Controller on 2007-09-11 20:36:49, 404 Not Found
- http://www.streamium.com/products/sl300i/ (archive)
- In GMediaServer - GNU UPnP media server (MIPSel) on 2007-09-11 20:36:57, 404 Not Found
- http://www.netgear.com/products/details/MP101.php (archive)
- In GMediaServer - GNU UPnP media server (MIPSel) on 2007-09-11 20:36:57, 404 Not Found
- http://downloads.nas-central.org/source_code/UNPACKED_GPL/gpl_ls-gl/
- In GPL Violations on 2007-09-11 20:37:00, 404 Not Found
- http://downloads.nas-central.org/source_code/UNPACKED_GPL/gpl_hs-dgl_hd-hglan/
- In GPL Violations on 2007-09-11 20:37:01, 404 Not Found
- http://downloads.nas-central.org/source_code/UNPACKED_GPL/gpl_hs-dgl_hd-hglan/
- In GPL Violations on 2007-09-11 20:37:01, 404 Not Found
- http://downloads.nas-central.org/source_code/UNPACKED_GPL/gpl_mipsel-hdhlan_v2/nkf203.tar
- In GPL Violations on 2007-09-11 20:37:00, 404 Not Found
- http://downloads.nas-central.org/source_code/UNPACKED_GPL/gpl_mipsel-hdhlan_v2/%95%e2%91%ab%8f%ee%95%f1.txt
- In GPL Violations on 2007-09-11 20:37:00, 404 Not Found
- http://downloads.nas-central.org/source_code/UNPACKED_GPL/gpl_powerpc-hdhlan_v1/
- In GPL Violations on 2007-09-11 20:37:01, 404 Not Found
- http://downloads.nas-central.org/source_code/UNPACKED_GPL/gpl_powerpc-hdhlan_v1/
- In GPL Violations on 2007-09-11 20:37:01, 404 Not Found
- http://downloads.nas-central.org/source_code/gpl_powerpc-hdhlan_v1.zip
- In GPL Violations on 2007-09-11 20:37:02, 404 Not Found
- http://downloads.nas-central.org/source_code/UNPACKED_GPL/gpl_mipsel-hdhlan_v2/
- In GPL Violations on 2007-09-11 20:37:02, 404 Not Found
- http://downloads.nas-central.org/source_code/UNPACKED_GPL/gpl_mipsel-hdhlan_v2/
- In GPL Violations on 2007-09-11 20:37:02, 404 Not Found
- http://downloads.nas-central.org/source_code/gpl_hs-dgl_hd-hglan.zip
- In GPL Violations on 2007-09-11 20:37:06, 404 Not Found
- http://downloads.nas-central.org/source_code/gpl_mipsel-hdhlan_v2.zip
- In GPL Violations on 2007-09-11 20:37:02, 404 Not Found
- http://downloads.nas-central.org/terastation/GPL/UNPACKED_GPL/gpl_hs-dtgl_hd-htgl/
- In GPL Violations on 2007-09-11 20:37:02, 404 Not Found
- http://downloads.nas-central.org/terastation/GPL/UNPACKED_GPL/gpl_hs-dtgl_hd-htgl/
- In GPL Violations on 2007-09-11 20:37:02, 404 Not Found
- http://downloads.nas-central.org/terastation/GPL/gpl_hs-dtgl_hd-htgl.zip
- In GPL Violations on 2007-09-11 20:37:03, 404 Not Found
- http://downloads.nas-central.org/terastation/GPL/UNPACKED_GPL/gpl_ts-tglR5/
- In GPL Violations on 2007-09-11 20:37:03, 404 Not Found
- http://downloads.nas-central.org/terastation/GPL/UNPACKED_GPL/gpl_ts-tglR5/
- In GPL Violations on 2007-09-11 20:37:03, 404 Not Found
GPL
- http://downloads.nas-central.org/terastation/GPL/gpl_ts-tglR5.zip
- In GPL Violations on 2007-09-11 20:37:03, 404 Not Found
- http://downloads.nas-central.org/LSPro_ARM9/Distributions/Genlink/boot(sda1
- In GenLink on 2007-09-11 20:37:03, 404 Not Found
- http://downloads.nas-central.org/LSPro_ARM9/Distributions/Genlink/Rootfs/GenLink_arm9-LATEST.tar.bz2
- In GenLink on 2007-09-11 20:37:03, 404 Not Found
- http://linkstationwiki.svn
- In GenLink on 2007-09-11 20:37:10, Socket Error: 'Name or service not known'
- http://downloads.nas-central.org/arm9-LS_Pro/Genlink/Binaries/armv5tejl-softfloat-linux-gnueabi/
- In GenLink on 2007-09-11 20:37:03, 404 Not Found
- http://www.buffalotech.com/products/product-detail.php?productid=132&categoryid=28 (archive)
- In Getting OpenLink working on a LS-HS on 2007-09-11 20:37:10, 404 Not Found
- http://downloads.nas-central.org/stock_firmware/hs-dgl_DirectCopy_149_107.zip
- In Getting OpenLink working on a LS-HS on 2007-09-11 20:37:06, 404 Not Found
- http://www.buffalotech.com/products/product-detail.php?productid=132&categoryid=28 (archive)
- In Getting OpenLink working on a LS-HS on 2007-09-11 20:37:10, 404 Not Found
- http://downloads.nas-central.org/openlink/hg-openlink-051b.zip
- In Getting OpenLink working on a LS-HS on 2007-09-11 20:37:06, 404 Not Found
- http://www.buffalotech.com/products/product-detail.php?productid=131&categoryid=28 (archive)
- In Getting OpenLink working on a LS-HS on 2007-09-11 20:37:10, 404 Not Found
- http://downloads.nas-central.org/openlink/tmpimages/tmpimage-OL-0.51-HG.tgz
- In Getting OpenLink working on a LS-HS on 2007-09-11 20:37:07, 404 Not Found
- http://homepage2.nifty.com/nijino/library/u-boot-1.1.4_kurobox-20060715.patch.bz2
- In HOWTO U-Boot on 2007-09-11 20:37:10, 404 Not found
- http://homepage2.nifty.com/nijino/kurobox/uboot_check.c
- In HOWTO U-Boot on 2007-09-11 20:37:13, 404 Not found
- http://downloads.nas-central.org/JTAG/MIPS/Hairydairymaid/
- In Hardware Hacks for the LS2 on 2007-09-11 20:37:10, 404 Not Found
- http://downloads.nas-central.org/powerpc-hdhglan/fw145b-ramdisk.txt
- In Information/HGFlashROM on 2007-09-11 20:37:12, 404 Not Found
-
- In Information/HGOverview on 2007-09-11 20:37:15, 404 Not Found
- http://downloads.nas-central.org/stock_firmware/hd-hglan_161.zip
- In Information/HGOverview on 2007-09-11 20:37:12, 404 Not Found
- http://www.buffalotech.com/downloads/HD_HGLAN_142.zip
- In Information/HGOverview on 2007-09-11 20:37:17, 404 Not Found
- http://www.buffalotech.com/support/downloads-product.php?productid=107 (archive)
- In Information/HGOverview on 2007-09-11 20:37:12, 404 Not Found
- http://www2.melcoinc.co.jp/pub/hd/hglan161.exe
- In Information/HGOverview on 2007-09-11 20:37:13, 404 Not Found
- http://www.mediabolic.com/products/nas.html (archive)
- In Information/LSPROOverview on 2007-09-11 20:37:26, 404 Not Found
- http://linkstation/cgi-bin/setup-sleep.cgi
- In Information/MIPSelAVR on 2007-09-11 20:37:14, Socket Error: 'Name or service not known'
- http://linkstation/cgi-bin/setup-sleep.cgi
- In Information/MIPSelAVR on 2007-09-11 20:37:14, Socket Error: 'Name or service not known'
- http://downloads.nas-central.org/stock_firmware/LS-GL_FW1.03.zip
- In Information/LSPROOverview on 2007-09-11 20:37:14, 404 Not Found
- http://www.buffalotech.com/products/product-detail.php?productid=155&categoryid=34%7C
- In Information/LSPROOverview on 2007-09-11 20:37:15, 404 Not Found
- http://www.kurobox.com/online/tiki-index.php?page=AddAUSBPort (archive)
- In Information/MIPSelOverview on 2007-09-11 20:37:15, 404 Not Found
- http://downloads.nas-central.org/powerpc-hdhlan/fw147-ramdisk.txt
- In Information/PPCFlashROM on 2007-09-11 20:37:16, 404 Not Found
- http://downloads.nas-central.org/powerpc-hdhlan/fw151-ramdisk.txt
- In Information/PPCFlashROM on 2007-09-11 20:37:16, 404 Not Found
- http://ftp.ucsb.edu/pub/mirro
- In Install Gentoo Linux on 2007-09-11 20:37:17, 404 Not Found
- http://www.gatech.edu/pub/gentoo/
- In Install Gentoo Linux on 2007-09-11 20:37:17, 404 Not Found
Ins
Error: 'Name or service not known'
- http://zd1211.ath.cx/ (archive)
- http://final-empire.sourceforge.net/cgi-bin/wiki.p
- In InterWikiPrefixes on 2007-09-11 20:37:28, 404 Not Found
- http://www2.iro.umontreal.ca/~paquetse/cgi-bin/wik
- In InterWikiPrefixes on 2007-09-11 20:37:29, Socket Error: 'Name or service not known'
Int
- http://www.asteriskdocs.org/modules/tinycontent/content/docbook/current_v1/docs-html/book1.html (archive)
- In Asterisk - the open source soft PBX (MIPSel) on 2007-09-11 20:39:32, Socket Error: 'Connection timed out'
- http://www.asteriskdocs.org/modules/tinycontent/content/docbook/internals/docs-html/book1.html (archive)
- In Asterisk - the open source soft PBX (MIPSel) on 2007-09-11 20:39:32, Socket Error: 'Connection timed out'
- https://projects.warp.es/projects/ebox-platform/wiki/Document/FAQ/HowToActivateSSH
- In EBox on FreeLink-Debian on 2007-09-11 20:39:51, Socket Error: 'Connection timed out'
- https://projects.warp.es/projects/ebox-platform/wiki/Document/FAQ/HowToAddFirewallServices
- In EBox on FreeLink-Debian on 2007-09-11 20:39:51, Socket Error: 'Connection timed out'
- https://projects.warp.es/projects/ebox-platform/wiki
- In EBox on FreeLink-Debian on 2007-09-11 20:39:51, Socket Error: 'Connection timed out'
Int
- http://downloads.nas-central.org/mipsel-hdhlan-LS2/mipsel-hdhlan-ipkg-0.99.153-1.tgz
- In Ipkg on the Linkstation (for end-users) on 2007-09-11 20:37:49, 404 Not Found
- http://fsbench.netnation.com/ (archive)
- In JFS Installation or Conversion for Boosting Performance on 2007-09-11 20:37:51, 406 Not Acceptable
- http://zd1211.ath.cx/download/zd1211-driver-r80.tgz
- http://www.soc-machines.com/====
- In JTAG instructions and hints on 2007-09-11 20:38:08, 404 Not Found
- http://zd1211.ath.cx (archive)
- http://genotix.nl/kai/runme.script
- In KAID - XLink Kai online gaming for Xbox, 360, PS2 and PSP on 2007-09-11 20:37:56, 404 Not Found
- http://downloads.nas-central.org/arm9-LS_Pro/Genlink/Binaries/armv5tejl-softfloat-linux-gnueabi/extra/ksysguard-daemon-3.5.6_arm9_glibc-2.3.6.tar.bz2
- In KDE ksysguardd on the Linkstation on 2007-09-11 20:37:56, 404 Not Found
- http://downloads.nas-central.org/packages/ppc/libdvdcss-1.2.9_ppc.tar.gz
- In Kissd kissdx on 2007-09-11 20:37:57, 404 Not Found
- http://downloads.nas-central.org/packages/ppc/libdvdread-0.9.7_ppc.tar.gz
- In Kissd kissdx on 2007-09-11 20:37:57, 404 Not Found
- http://downloads.nas-central.org/uploads/LS_Pro_temporary/Tarballs/libdvdread-0.9.7_arm9.tar.gz
- In Kissd kissdx on 2007-09-11 20:37:58, 404 Not Found
- http://www.vidartysse.net/kissdx/kissdx-0.12-4.zip
- In Kissd kissdx on 2007-09-11 20:38:00, 404 Not Found
- http://downloads.nas-central.org/packages/ppc/kissdx_0.12-4_ppc.tar.gz
- In Kissd kissdx on 2007-09-11 20:37:58, 404 Not Found
- http://downloads.nas-central.org/uploads/LS_Pro_temporary/Tarballs/kissdx_0.13-10a_arm9.tar.gz
- In Kissd kissdx on 2007-09-11 20:37:59, 404 Not Found
- http://www.pecknet.com/photoNet/index.php/mode=recent/offset=0/album=Fedora-Kuro/photo=img_5750-scaled.jpg/index.html#picture (archive)
- In Kurowiki News on 2007-09-11 20:38:11, 404 Not Found
- http://genbako.vodapone.com/kurobox-sources-2.6.17.patch (archive)
- In LCDKuro on 2007-09-11 20:38:06, 404 Not Found
- http://packages.gentoo.org/packages/?category=sys-apps;name=kbd (archive)
- In LCDKuro on 2007-09-11 20:38:09, 404 Not Found
LS
- http://www.buffalotech.com/products/storage.php (archive)
- In LS Hardware and Software information on 2007-09-11 20:38:08, 404 Not Found
- http://downloads.nas-central.org/arm9-LS_Pro/LS-GL_FW_103-jtymod3.zip
- In LS-Pro - jtymod telnet enabled firmware on 2007-09-11 20:38:08, 404 Not Found
- http://downloads.nas-central.org/packages/mips/lighttpd-1.4.12_mips.tar.gz
- In Lighttpd - Compile & Run on MIPSel Linkstation (LS2) on 2007-09-11 20:38:09, 404 Not Found
- http://oldforum.nas-central.org
- In Linkstationwiki.NET history on 2007-09-11 20:38:17, Socket Error: 'Name or service not known'
- http://downloads.nas-central.org/uploads/LS_Pro_temporary/NativeToolchain/ls-gl-pro-native-toolchain.tar.gz
- In Linkstationwiki.NET history on 2007-09-11 20:38:13, 404 Not Found
- http://downloads.nas-central.org/development_tools/ppc-tools-2_1.tgz
- In Linkstationwiki.NET history on 2007-09-11 20:38:14, 404 Not Found
- http://downloads.nas-central.org/development_tools/mipsel-tools-2_1.tgz
- In Linkstationwiki.NET history on 2007-09-11 20:38:14, 404 Not Found
- http://downloads.nas-central.org/source_code/gpl_hs-dgl_hd-hglan.zip
- In GPL Violations on 2007-09-11 20:37:06, 404 Not Found
- http://downloads.nas-central.org/terastation/GPL/gpl_hs-dtgl_hd-htgl.zip
- In GPL Violations on 2007-09-11 20:37:03, 404 Not Found
- http://downloads.nas-central.org/terastation/GPL/gpl_ts-tglR5.zip
- In GPL Violations on 2007-09-11 20:37:03, 404 Not Found
- http://www.tomsnetworking.com/2005/06/27/review_hdhg250lan/
- In Main/ExternalLinks on 2007-09-11 20:38:28, 410 Gone
- http://www.kurobox.com/online/tiki-index.php?page=Welcome (archive)
- In Main/ExternalLinks on 2007-09-11 20:38:21, 404 Not Found
- http://linkstation.yi.org/ (archive)
- In Main/ExternalLinks on 2007-09-11 20:38:23, 403 Forbidden
- http://www.buffalotech.com/buffalo-home.php (archive)
- In Main/ExternalLinks on 2007-09-11 20:38:25, 404 Not Found
- http://revogear.com/forums/viewtopic.php?t=21 (archive)
- In Manual Setup on 2007-09-11 20:38:27, 404 Not Found
Med
- http://sms.ps2-scene.org/eng/manual.html (archive)
- In Media Bridge PS2 on 2007-09-11 20:38:35, 404 Not Found
- http://dev.oopo.net/files/ps2client-3.0.0.tgz
- In Media Bridge PS2 on 2007-09-11 20:38:41, 404 Not Found
- http://downloads.nas-central.org/mirrors/linkstationbinaries.webhop.net/ppc/mc_ppc261.tgz
- In Midnight Commander on 2007-09-11 20:38:30, 404 Not Found
- http://www.swelltech.com/support/webminguide/ch13.html#exports (archive)
- In NFS tutorial - Get the Network File System running on 2007-09-11 20:38:36, Socket Error: 'Name or service not known'
- http://downloads.nas-central.org/packages/ppc/ppc-openlink-2.6-kernel-NFS-V3.tar.gz
- In NFS tutorial - Get the Network File System running on 2007-09-11 20:38:36, 404 Not Found
- http://www.swelltech.com/support/webminguide/ch13.html#exports (archive)
- In NFS tutorial - Get the Network File System running on 2007-09-11 20:38:36, Socket Error: 'Name or service not known'
- http://www.sowbug.org/mt/archives/000179.html (archive)
- In Obtain the zip password for the LinkStation firmware image.dat on 2007-09-11 20:38:38, 404 Not Found
- http://downloads.nas-central.org/arm9-LS_Pro/telnet_enabled_no_root_password/LS-GL-103.zip
- In Open Stock Firmware on 2007-09-11 20:38:44, 404 Not Found
- http://downloads.nas-central.org/uploads/LS_Pro_temporary/telnet_enabled_no_root_password/
- In Open Stock Firmware on 2007-09-11 20:38:44, 404 Not Found
- http://downloads.nas-central.org/arm9-LS_Pro/telnet_enabled_no_root_password/LS-GL_FW_103-modified.zip
- In Open Stock Firmware on 2007-09-11 20:38:44, 404 Not Found
- http://downloads.nas-central.org/arm9-LS_Pro/telnet_enabled_no_root_password/enable-telnet.sh
- In Open Stock Firmware on 2007-09-11 20:38:43, 404 Not Found
- http://downloads.nas-central.org/powerpc-hdhlan/ppc-openssh-3.9p1-05b.tgz
- In OpenSSH (including daemon) for OpenLink on 2007-09-11 20:38:39, 404 Not Found
- http://downloads.nas-central.org/arm9-LS_Pro/telnet_enabled_no_root_password/LSPro-103.2.zip
- In Open Stock Firmware on 2007-09-11 20:38:43, 404 Not Found
- http://downloads.nas-central.org/development_tools/mipsel-tools-2_1.tgz
- In Linkstationwiki.NET history on 2007-09-11 20:38:14, 404 Not Found
- http://downloads.nas-central.org/uploads/
- In Oxyl~box (ppc) on 2007-09-11 20:38:44, 404 Not Found
- https://developer.berlios.de/project/showfiles.php?group_id=2509
- In PeerGuardian BlockList Filter for HG on 2007-09-11 20:38:47, HTTP Redirect Loop: [26] -> [27]
- http://www.stanford.edu/~epop/igal/ (archive)
- In Photo Gallery with igal - online image gallery generator on 2007-09-11 20:38:47, 404 Not Found
-
(archive)
- In Photo Gallery with igal - online image gallery generator on 2007-09-11 20:38:47, 404 Not Found
- http://www.stanford.edu/~epop/igal/igal-1.4.tar.gz (archive)
- In Photo Gallery with igal - online image gallery generator on 2007-09-11 20:38:46, 404 Not Found
- http://sms.ps2-scene.org/eng/index.htm (archive)
- In Playstation 2 on 2007-09-11 20:38:48, 404 Not Found
- http://downloads.nas-central.org/cross-toolchains/configs/
- In Build additional kernel modules on 2007-09-11 20:36:25, 404 Not Found
Pre
- http://downloads.nas-central.org/development_tools/
- In Precompiled C development environment, running on the LS on 2007-09-11 20:38:49, 404 Not Found
- http://downloads.nas-central.org/cross-toolchains/i686-pc-cygwin_powerpc-hdhglan-linux-2.0.tar.bz2
- In Precompiled C Cross-Toolchain on 2007-09-11 20:38:49, 404 Not Found
- http://svn.artage.com/svn/linkstation/trunk/HOWTO
- In Recreate the Openlink distribution using buildroot on 2007-09-11 20:38:51, 404 Not Found
- http://genbako.vodapone.com/kurobox-sources-2.6.17.patch (archive)
- In LCDKuro on 2007-09-11 20:38:06, 404 Not Found
- http://mxhaard.free.fr/spca50x/Download/spca5xx-20060501.tar.gz (archive)
- In Sekuro-box on 2007-09-11 20:39:06, 404 Not Found
- http://www.saillard.org/linux/pwc/snapshots/pwc-v4l2-20060627-042701.tar.bz2
- In Sekuro-box on 2007-09-11 20:39:06, 404 Not Found
- http://downloads.nas-central.org/powerpc-hdhlan-LS1/
- In SlimServer on the PPC LinkStation on 2007-09-11 20:39:08, 404 Not Found
- http://downloads.nas-central.org/openlink/powerpc-hdhlan-openlink-0.73b.zip
- In SlimServer server software that powers audio players from SlimDevices on 2007-09-11 20:39:07, 404 Not Found
JTAG for the LS Pro and LS Live
Background
Tampakuro/kuroguy discovered the layout of the JTAG Port on an LS Pro v1 and an early KuroPro by tracing the wiring. The account of his work and other early efforts is here : JTAG for the LS Pro and LS Live. He found that the v1 had a non-standard pinout. The v2 LS Live has a standard ARM 20 pin layout. mdfirefighter and others discovered that Dominic Rath's OpenOCD software was the key to opening the LS Pro to JTAG - this is detailed in the same thread linked to above. At these early stages, OpenOCD did not offer any support for the Feroceon processor that our boxes run on, but instead we got by on a close relative, the ARM926EJS. Recent developments include some built-in support for the Feroceon in OpenOCD (revision 315 and later).
Why use JTAG?
- JTAG provides low-level access to a flash chip. This is necessary if you need to fix a serious UBoot problem on your LinkStation.
- It gives direct access to the processor (probably on useful for developers).
- If you are developing a new bootloader, it gives you the freedom to experiment without having to worry about bricking your box.
When not to use it
JTAG access is more invasive than attaching a serial connector. It should not be your first choice if:
- you are trying to recover from flashing a v1 UBoot to your v2 LS Pro (just use a serial connection for this, use the LS Updater while in EM)
- you are looking for something cool to do (sane people, even developers, have been known to really break things while playing around)
Required Hardware,Software & Preparation
=DISCLAIMER
CAUTION : USE AT YOUR OWN RISK. IT IS POSSIBLE TO BRICK ONE'S BOX WITH THESE METHODS. UNBRICKING IS NOT GUARANTEED. YOU HAVE BEEN WARNED. These directions have been tested and checked on a LSProV2. YMMV.
Hardware
- An LS Pro (or LS Live, though it hasn't been tested on the Live yet)
- JTAG headers already attached to your ARM-based LinkStation's board (see [ Add a JTAG Port] for details - you may want to consider low profile headers)
- JTAG adapter like the Olimex ARM-USB-TINY (tested) or a Wiggler (Wigglers and other paraport adapters reportedly work, but seem slower than USB)
- an x86 desktop/laptop running Linux (tested w/ Ubuntu 7.10)
Getting, Compiling and Configuring OpenOCD
The OCD software we use is OpenOCD, created by Dominic Rath. You basically have two options here:
- Build it from svn for the Feroceon support and the latest (perhaps bleeding edge) features, or
- build it from the pre-Feroceon source, available for download from here. Note that the config file in this package, found in docs/configs/lsp_wig.cfg is already set up and tested with parallel port interfaces, like for the Wiggler.
- Compiling: See Building OpenOCD for full details. The directions are listed below for using it with the Olimex JTAG USB TINY adapter, which is ftdi-based. Read the INSTALL file for details on building it for parallel port Wiggler devices.
- Install libftdi (http://www.intra2net.com/opensource/ftdi/) or libftd2xx (http://www.ftdichip.com/Drivers/D2XX.htm). Most accounts seem to indicate that more users have better luck with libftdi (which is available as a package for Ubuntu, for instance.)
- Build and install OpenOCD. Download it from the downloads on our site, or from svn at the OpenOCD site. For svn revision 335, a trivial patch was necessary (see patch). Then bootstrap, configure, make and make install.
./bootstrap ./configure --enable-ft2232_libftdi make make install
Also, if you are using libftdi, you may have to add the following line to your /etc/fstab:
none /proc/bus/usb usbfs defaults,devmode=0666 0 0
If you are using a parallel port Wiggler, you should read the literature and docs in the source, as they will guide you on what to do in terms of configuring before building.
- Configuring OpenOCD - Again, see Configuring OpenOCD for details. Hints below show a config file that was used to flash a LS Pro V2 using OpenOCD svn revision 335, with an Olimex ARM-USB-TINY unit. (Note:The config file in the openocd-package in the downloads section is set up for parallel port Wiggler devices.)
# daemon config telnet_port 4444 gdb_port 3333 daemon_startup attach # interface jtag_speed 0 interface ft2232 ft2232_layout "olimex-jtag" ft2232_vid_pid 0x15ba 0x0004 # use combined on interfaces or targets that can't set TRST/SRST separately reset_config srst_only #reset_config trst_and_srst # jtag scan chain #format L IRC IRCM IDCODE (Length, IR Capture, IR Capture Mask, IDCODE) jtag_device 4 0x1 0xf 0xe #jtag_nsrst_delay 500 #jtag_ntrst_delay 500 # target configuration # target <type> <endianess> <reset_mode> # if chain_pos is not zero it seg faults #target arm926ejs little reset_init 0 target feroceon little reset_init 0 run_and_halt_time 0 30 #working_area 0 0xc8010000 0x400 nobackup # flash configuration # flash bank <driver> <base> <size> <chip_width> <bus_width> [driver_options ...] flash bank cfi 0xfffc0000 0x00040000 1 1 0 jedec_probe
Flashing U-Boot to Your LS Pro
Read through these directions completely and rehearse them for maximum success. 0. Required Software and Equipment, connected and/or ready. Attach the JTAG cable/connector to the header on your LS Pro while it is powered off. Have OpenOCD already compiled and your configuration file set up and checked.
1. Have two open windows/terminals with commands all ready to execute some commands.
- In one terminal window, cd to the directory where your config file is located. We'll call this the OpenOCD Window from here on out. As root, type in the command
openocd -f lsp_wig.cfg
but do not press enter yet. The filename lsp_wig.cfg is just an example and should be changed to whatever your config file is.
- In a second terminal window (called the Daemon Window from here on out), cd to where ever your image file for UBoot is. Then, as root, type the command
telnet localhost 4444
but do not press enter yet. Note that the Daemon Window is where all of your commands will be entered and executed through.
2. Press & hold the reset button, and press the power button on your ARM-based LinkStation. If you do this right, it will make a musical tone 1 or 2 seconds after pressing the power button.
3. Start openocd and connect to daemon by pressing enter in the OpenOCD Window, and then in the Daemon Window. You will see the following in those two windows, respectively:
root@bytebaker-i686:/home/davygravy/Desktop/configs# openocd -f lsp_wig.cfg Info: openocd.c:86 main(): Open On-Chip Debugger (2007-04-26 16:40 CEST) Error: embeddedice.c:190 embeddedice_build_reg_cache(): unknown EmbeddedICE version (comms ctrl: 0x00000018)
The error seems commonplace to most of us that have used it. Until we know otherwise, most of us are assuming it is not a huge problem. OpenOCD is now running. In the Daemon Window you will see something similar to this:
root@bitbaker-i686:/usr/src# telnet localhost 4444 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'.
4. Quickly halt your processor by entering one of these commands in the Daemon Window:
halt reset soft_reset_halt
You may have to go through the entire list. In any case, the processor must be halted (and maybe reset performed) in order to get flash access. You will see something like this as output in the Daemon Window:
> halt requesting target halt... > Target 0 halted target halted in ARM state due to debug request, current mode: Abort cpsr: 0x600000d7 pc: 0x00000028 MMU: disabled, D-Cache: disabled, I-Cache: enabled
or if your processor is in some state where it needs more convincing, you may see something like this:
> halt requesting target halt... waiting for target halted... timed out while waiting for target halted timed out while waiting for target halted > reset > soft_reset_halt requesting target halt and executing a soft reset value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f in_handler reported a failed check Target 0 halted target state: halted target halted in ARM state due to debug request, current mode: Supervisor cpsr: 0x000000d3 pc: 0x00000000 MMU: disabled, D-Cache: disabled, I-Cache: disabled
This is a stage which has proven to be unpredictably difficult. You may have to wait more than 10 seconds to get a confirmation on a halt, and you may have to repeat it. Again, no flash access is possible without a halted processor.
5. Verify and probe your flash bank by executing the following commands:
flash banks flash probe 0
The 'flash banks' may be omitted - it is optional. The output will look similar to this:
> flash banks #0: cfi at 0xfffc0000, size 0x00040000, buswidth 1, chipwidth 1 > flash probe 0 flash 'cfi' found at 0xfffc0000
Once this is done, you have verified that you have proper access to the flash.
6. Erase flash bank and check erasure. Do not interrupt the process. Execute the following:
flash erase 0 0 63 flash erase_check 0
The output will look similar to this:
> flash erase 0 0 63 erased sectors 0 through 63 on flash bank 0 in 4s 484466us > flash erase_check 0 successfully checked erase state
7. Write the UBoot image to flash. This may take anywhere from about an hour up to 5 or 6 hours. Do not interrupt the process. Execute the following:
flash write 0 lspstock052207.bin 0xfffc0000
The file to be used as an image for flash should be changed to fit your situation (the one shown is for a LS Pro V1).
> flash write 0 /usr/src/openocd-package/doc/configs/lspstock052207.bin 0xfffc0000 wrote file /usr/src/openocd-package/doc/configs/lspstock052207.bin to flash bank 0 at offset 0xfffc0000 in 12107s 811284us
8. To check to see if your flashing was successful (that the file you wanted to write to flash was actually written), dump it out:
dump_image currentcontents.bin 0xfffc0000 0x40000
and then in a third terminal window, compare or diff them:
diff currentcontents.bin lspstock052207.bin
The second command should return nothing if the flash contents are identical to the image file. If the contents are the same as the image file, then you have successfully flashed the ROM with that image file. If it was a valid UBoot image, then it should boot up if there is a valid OS on the hdd and the UBoot env vars are correctly set.
9. Power down and restart. This is the moment of truth. Power down the LS by either holding the power button (safest) or unplugging it. Now restart. A serial cable attachment will be your friend here as it will give an indication of success:
Reference, Notes and Special Situations
- For a look at development of OpenOCD, see the OpenOCD Development List Archives
- A forum for OpenOCD users is hosted by SparkFun - great for posting problems and searching for answers.
- Be aware that as of svn r332, Feroceon (not a true ARM926) is still not officially supported by OpenOCD. Success is not guaranteed...at least a handful of us have flashed once or twice, and then been able to proceed with a third flash. Presumably, the processor was in a state that allowed us to do the first flash(es) but for some unknown reason comes to be in some less manageable state. The difficulty for some of us has been getting the processor halted.
- OpenOCD svn revision 335 with a small patch gave success for me, after I patched the source (acknowledgement to bbradley for the patch). In src/target/feroceon.c, find these lines:
/* asserting DBGRQ won't win over the undef exception */ arm7_9->use_dbgrq = 0 ;
change the 0 to 1:
/* asserting DBGRQ won't win over the undef exception */ arm7_9->use_dbgrq = 1 ;
and then compile normally. Note that the 'halt' command didn't work, nor did reset. The only way to get it halted was to do a soft_reset_halt and simultaneously connect pins (RTCK) and (sRST) long enough to get it to halt. (Do this at your own risk.)
root@bytebaker-i686:/home/davygravy# telnet localhost 4444 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Open On-Chip Debugger > halt requesting target halt... waiting for target halted... timed out while waiting for target halted timed out while waiting for target halted > reset > soft_reset_halt requesting target halt and executing a soft reset value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f in_handler reported a failed check ... value captured during scan didn't pass the requested check: captured: 0x0f check_value: 0x01 check_mask: 0x0f in_handler reported a failed check Target 0 halted target state: halted target halted in ARM state due to debug request, current mode: Supervisor cpsr: 0x000000d3 pc: 0x00000000 MMU: disabled, D-Cache: disabled, I-Cache: disabled > flash probe 0 probing failed for flash bank '#0' at 0xfffc0000 > flash probe 0 flash 'cfi' found at 0xfffc0000 > flash probe 0 flash 'cfi' found at 0xfffc0000 > flash erase 0 0 63 erased sectors 0 through 63 on flash bank 0 in 2.822007s > flash erase_check 0 not enough working area available(requested 20, free 0) no working area available, falling back to slow memory reads successfully checked erase state > flash write 0 /home/davygravy/Desktop/configs/lspro-v2flash.bin 0xfffc0000 not enough working area available(requested 96, free 0) no working area available, can't do block memory writes Programming at fff80000, count 00040000 bytes remaining Programming at fff80100, count 0003ff00 bytes remaining Programming at fff80200, count 0003fe00 bytes remaining ... Programming at fffbfc00, count 00000400 bytes remaining Programming at fffbfd00, count 00000300 bytes remaining Programming at fffbfe00, count 00000200 bytes remaining Programming at fffbff00, count 00000100 bytes remaining Fixup 1 unaligned tail bytes wrote 262144 byte from file /home/davygravy/Desktop/configs/lspro-v2flash.bin to flash bank 0 at offset 0xfffc0000 in 6522.530762s (0.039249 kb/s) > dump_image currentcontents.bin 0xfffc0000 0x40000 dumped 262144 byte in 18.345442s > exit Connection closed by foreign host. root@bytebaker-i686:/home/davygravy#
Flash structure
For the LSProV2, here is the output of flinfo while in u-boot:
Marvell>> flinfo Bank # 1: SST SST39VF020 (2 Mbit) Size: 256 kB,Bus Width: 1, device Width: 1. Flash base: 0xfffc0000,Number of Sectors: 64 Type: REGULAR. Sector Start Addresses: 00000000 (RO) 00001000 (RO) 00002000 (RO) 00003000 (RO) 00004000 (RO) 00005000 (RO) 00006000 (RO) 00007000 (RO) 00008000 (RO) 00009000 (RO) 0000a000 (RO) 0000b000 (RO) 0000c000 (RO) 0000d000 (RO) 0000e000 (RO) 0000f000 (RO) 00010000 (RO) 00011000 (RO) 00012000 (RO) 00013000 (RO) 00014000 (RO) 00015000 (RO) 00016000 (RO) 00017000 (RO) 00018000 (RO) 00019000 (RO) 0001a000 (RO) 0001b000 (RO) 0001c000 (RO) 0001d000 (RO) 0001e000 (RO) 0001f000 (RO) 00020000 (RO) 00021000 (RO) 00022000 (RO) 00023000 (RO) 00024000 (RO) 00025000 (RO) 00026000 (RO) 00027000 (RO) 00028000 (RO) 00029000 (RO) 0002a000 (RO) 0002b000 (RO) 0002c000 (RO) 0002d000 (RO) 0002e000 (RO) 0002f000 (RO) 00030000 (RO) 00031000 (RO) 00032000 (RO) 00033000 (RO) 00034000 (RO) 00035000 (RO) 00036000 (RO) 00037000 (RO) 00038000 (RO) 00039000 (RO) 0003a000 (RO) 0003b000 (RO) 0003c000 (RO) 0003d000 (RO) 0003e000 (RO) 0003f000
- Available Commands in OpenOCD - Listed for reference. While working in the telnet daemon window w/ OpenOCD, entering the command help will yield a list of available commands and summary of help.
> help help display this help sleep sleep for <n> milliseconds version show OpenOCD version shutdown shut the server down exit exit telnet session log_output redirect logging to <file> (default: stderr) debug_level adjust debug level <0-3> jtag_speed set jtag speed (if supported) <speed> scan_chain print current scan chain configuration endstate finish JTAG operations in <tap_state> jtag_reset toggle reset lines <trst> <srst> runtest move to Run-Test/Idle, and execute <num_cycles> statemove move to current endstate or [tap_state] irscan execute IR scan <device> <instr> [dev2] [instr2] ... drscan execute DR scan <device> [ dev2 ] [var2] ... verify_ircapture verify value captured during Capture-IR <enable|disable> var allocate, display or delete variable <name> [num_fields|"del"] [size1] ... field display/modify variable field <field> [value|"flip"] script execute commands from <file> xsvf run xsvf <file> targets no help available flash no help available banks - list configured flash banks info - print info about flash bank <num> probe - identify flash bank <num> erase_check - check erase state of sectors in flash bank <num> protect_check - check protection state of sectors in flash bank <num> erase - erase sectors at <bank> <first> <last> write - write binary <bank> <file> <offset> protect - set protection of sectors at <bank> <first> <last> <on|off> nand no help available pld programmable logic device commands arm7_9 arm7/9 specific commands write_xpsr - write program status register <value> <not cpsr|spsr> write_xpsr_im8 - write program status register <8bit immediate> <rotate> <not cpsr|spsr> write_core_reg - write core register <num> <mode> <value> sw_bkpts - support for software breakpoints <enable|disable> force_hw_bkpts - use hardware breakpoints for all breakpoints (disables sw breakpoint support) <enable|disable> dbgrq - use EmbeddedICE dbgrq instead of breakpoint for target halt requests <enable|disable> fast_writes - (deprecated, see: arm7_9 fast_memory_access) fast_memory_access - use fast memory accesses instead of slower but potentially unsafe slow accesses <enable|disable> dcc_downloads - use DCC downloads for larger memory writes <enable|disable> etb_dump - dump current ETB content armv4_5 armv4/5 specific commands reg - display ARM core registers core_state - display/change ARM core state <arm|thumb> disassemble - disassemble instructions <address> <count> ["thumb"] arm9tdmi arm9tdmi specific commands vector_catch - catch arm920t vectors ["all"|"none"|"<vec1 vec2 ...>"] arm926ejs arm926ejs specific commands cp15 - display/modify cp15 register <opcode_1> <opcode_2> <CRn> <CRm> [value] cache_info - display information about target caches virt2phys - translate va to pa <va> mdw_phys - display memory words <physical addr> [count] mdh_phys - display memory half-words <physical addr> [count] mdb_phys - display memory bytes <physical addr> [count] mww_phys - write memory word <physical addr> <value> mwh_phys - write memory half-word <physical addr> <value> mwb_phys - write memory byte <physical addr> <value> cfi no help available reg no help available poll poll target state wait_halt wait for target halt [time (s)] halt halt target resume resume target [addr] step step one instruction reset reset target [run|halt|init|run_and_halt|run_and_init] soft_reset_halt halt the target and do a soft reset mdw display memory words <addr> [count] mdh display memory half-words <addr> [count] mdb display memory bytes <addr> [count] mww write memory word <addr> <value> mwh write memory half-word <addr> <value> mwb write memory byte <addr> <value> bp set breakpoint <address> <length> [hw] rbp remove breakpoint <adress> wp set watchpoint <address> <length> <r/w/a> [value] [mask] rwp remove watchpoint <adress> load_image load_image <file> <address> ["bin"|"ihex"] dump_image dump_image <file> <address> <size> load_binary [DEPRECATED] load_binary <file> <address> dump_binary [DEPRECATED] dump_binary <file> <address> <size>