jonsmirl's blog

Urjtag git tree

I made a git tree for urjtag at It contains my patches to make a Phytec pcm030 work. Note that I had to revise the previous posting of instructions on using urjtag due to some problems I later found.

The concept of a bus in urjtag is not the same as a bus on the mpc5200. The mpc5200 has one local bus. That one bus can be in various modes controlled by pins sampled at reset. The local bus then allows different regions containing 8, 16 or 32 bit devices.

In urjtag these two things are combined. You also can't delete a bus once it is loaded. So when urjtag starts it defaults to non-multiplexed, 24b address and 8b data on bus 0. I implemented 25b address, 16b data with a multiplexer. When you initbus with the mux parameter it becomes bus 1. You use "bus 1" to switch to this new bus. This was very confusing to me since my chip only has one bus and urjtag has defined two.

Code is in the git tree. It's just a snapshot of their SVN plus my fixes. I'll keep it updated as I get my patches accepted or I find more bugs.


I've submitted patches to urtag to add support for our Phytec pcm030's. The Phytec cards have a multiplexed address and data bus. I had to modify urjtag to first latch the address and then do data operations. The patches should appear in the urtag SVN repository in a few days.

We don't have access to the on-chip debugger for the mpc5200. Apparently the specs for the PowerPC on-chip debugger are considered super secret and you have to sign piles of NDAs and agree to never show your source code. Contrast that with ARM where the specs are total open. There's a reason why ARM debuggers cost $50 and PowerPC ones are $3,000. If I really wanted to access on-chip debug I could buy a $3,000 debugger. Meanwhile printf() is free.

Even though the on-chip debugger is closed the rest of JTAG is standardized. We can still use the mpc5200 JTAG controller with open source software to control the pins on the mpc5200. That's where ujtag comes in.

First I bought one of these ARM JTAG devices from Sparkfun.

They also have a cheaper model.

The Phytec card has a Freescale/Motorola 16-pin COP/BDM layout. The standard ARM layout supported by these Olimex JTAGs is 20 pins. I cut my 20 pin cable in half and made a 16-pin connector for it. So mess around for a while and get urjtag compiled. urtag and these Olimex devices work on both Linux and Windows. I'm using Linux.

I have the first JTAG device and Tyler has the second one. I wanted the first one because it integrates a serial port with the debugger. I run the JTAG cable and a serial cable from the debugger to my board. Then a single USB cable back to my host. Note that the kernel driver for the FTDI FT2232C chip used in the dual port JTAG was broken in Linux 2.6.28, it is fixed in 2.6.29. You also need to set the permissions on the USB /dev device so that you can access the device.

Start up urjtag and set the cable.

root@terra:/home/jonsmirl# jtag

UrJTAG 0.9 #1460-jds
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008 Kolja Waschk and the respective authors

UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.

WARNING: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.

jtag> cable ARM-USB-OCD
Connected to libftdi driver.

If it can't find your JTAG device the permissions on the /dev device are wrong.

Now detect the devices present on the JTAG chain.

jtag> detect
IR length: 6
Chain length: 1
Device Id: 00010000000000010001000000011101 (0x000000001001101D)
  Manufacturer: Freescale (Motorola)
  Part(0):         mpc5200
  Stepping:     B
  Filename:     /usr/local/share/urjtag/freescale/mpc5200/mpc5200
Non-MUXed 24b address, 8b data bus
Initialized bus 0, active bus 0

It finds the mpc5200 CPU. urjtag defaults to a 24b address and 8b non-multiplex bus. Change this to the 25b address 16b data multiplexed bus on the Phytex card.

jtag> initbus mpc5200 mux
MUXed 25b address, 16b data bus
Initialized bus 1, active bus 0

This initializes a second bus definition which matches the bus multiplexer hardware on a pcm030.

jtag> print bus
*0: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0)
1: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0)
jtag> bus 1
jtag> print bus
0: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0)
*1: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0)

Switch to the new bus.

jtag> print
 No. Manufacturer              Part                 Stepping Instruction          Register                        
   0 Freescale (Motorola)      mpc5200              B        BYPASS               BR                              

Active bus:
*1: Freescale MPC5200 compatible bus driver via BSR (JTAG part No. 0)
	start: 0x00000000, length: 0x0C000000, data width: 16 bit, (LocalPlus Bus)

Search for the flash chip. The flash chip used by Phytec is a CFI type.

jtag> detectflash 0
Query identification string:
	Primary Algorithm Command Set and Control Interface ID Code: 0x0001 (Intel/Sharp Extended Command Set)
	Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
	Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
	Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
	Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
	Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
	Typical timeout per single byte/word program: 64 us
	Typical timeout for maximum-size multi-byte program: 128 us
	Typical timeout per individual block erase: 1024 ms
	Typical timeout for full chip erase: 0 ms
	Maximum timeout for byte/word program: 256 us
	Maximum timeout for multi-byte program: 1024 us
	Maximum timeout per individual block erase: 4096 ms
	Maximum timeout for chip erase: 0 ms
Device geometry definition:
	Device Size: 16777216 B (16384 KiB, 16 MiB)
	Flash Device Interface Code description: 0x0002 (x8/x16)
	Maximum number of bytes in multi-byte program: 32
	Number of Erase Block Regions within device: 1
	Erase Block Region Information:
		Region 0:
			Erase Block Size: 131072 B (128 KiB)
			Number of Erase Blocks: 128

It found our 16MB flash chip. Now before you mess your board up, make a copy of u-boot and save it. An x86 is a little endian machine, our PowerPC is big endian. Tell urjtag that the byte sex is opposite. Don't forget the endian command in each session. Without this the files you save and restore won't work.

jtag> endian big

The default flash partitions of the Phytec card look like this.

			partition@0 {
				label = "ubootl";
				reg = <0x00000000 0x00040000>;
			partition@40000 {
				label = "kernel";
				reg = <0x00040000 0x001c0000>;
			partition@200000 {
				label = "jffs2";
				reg = <0x00200000 0x00D00000>;
			partition@f00000 {
				label = "uboot";
				reg = <0x00f00000 0x00040000>;
			partition@f40000 {
				label = "oftree";
				reg = <0x00f40000 0x00040000>;
			partition@f80000 {
				label = "space";
				reg = <0x00f80000 0x00080000>;

You want to copy the second flash image and save it to a backup file. Flash looks like normal memory so use the readmem command. This takes a couple of minutes. JTAG is much slower than using a program to write the flash. JTAG arranges all of the pins on the mpc5200 chip as a big shift register. By shifting different values into the pins we can make it look like the CPU is running and manipulating the flash chip when it really is not. But this process is slow. You have to shift in 250 pin values to set ALE high, then another 250 pin values to set ALE low and so on. But the process does work and it lets you get an image into a blank flash chip. Use the eraseflash and flashmem commands to do this.

jtag> readmem 0x00f00000 0x00040000 /home/jonsmirl/saveme
address: 0x00F00000
length:  0x00040000
addr: 0x00F40000

The dr command shows you all those bits being shifted around.

jtag> dr

JTAG is also very useful for testing the board. The JTAG device lets you set and read the state of the signal pins on the device.

jtag> get signal LP_ALE_B
LP_ALE_B = 0
jtag> set signal LP_ALE_B out 1
jtag> shift dr
jtag> shift dr
jtag> get signal LP_ALE_B
LP_ALE_B = 1

Tyler's going to post more about this later when he demo's his fancy new 34-channel logic analyzer.

Urjtag has a nice manual that describes all of these commands in much more detail.

u-boot for prototype 6

I've ported the Phytec PCM030 u-boot patches up to u-boot head. The Phytec patches were from a three year old snap shot of u-boot. Patches are in the git tree.

This is in preparation for writing a Digispeaker specific u-boot to run on the Prototype 6 boards.

The flash layout needs some design effort. The 8MB NOR flash chips on the board have 128KB erase regions. To store a 2KB u-boot environment I need to consume a 128KB block of flash. The default boot address of the mpc5200 is at 7MB into the 8MB flash. That also splits the flash into two regions.

The current plan is to move the boot address to the start of the 8MB region and put u-boot there. I have a lot of stuff built into the u-boot image and it takes 384KB. I'll make the other 7.5MB of flash into a jffs2 file system. The kernel image, intellon firmware, oftree, and main filesystem will all be in the big jffs2 partition. u-boot knows how to read files out of jffs2. I can boot the kernel out of the filesystem without having it in its own partition. Merging all of these files into a single jffs2 partition gets rid of a lot of 128KB sector sized fragmentation.

I may move the u-boot environment into the end of the uboot partition and have the environment share a sector with the end of u-boot. That's not a recommend configuration since a crash during environment update will ruin the u-boot copy. On the other hand only a developer will update their u-boot environment and they should be able to recover.

Implementing an IR receiver

I've built my IR receiver out of Radio Shack parts. It's all soldered together and it is working.

Currently it is hooked up to GPIO_WKUP_7. This is a normal GPIO pin that is capable of generating interrupts. Unfortunately the Linux kernel doesn't have support for interrupting GPIOs on PowerPC. So I've spent the last two days writing it.

The problem with interrupting GPIOs is that there is one interrupt per GPIO group and a GPIO group may have between 8 and 32 GPIOs. When the one shared interrupt activates you need to provide a chained interrupt handler for it. This chained handler figures out which of the 8-32 GPIOs caused the interrupt and then chains again into the specific interrupt handler for that GPIO pin. Support for all of these chained handlers is running about 800 lines of C code.

If you look at how IR protocols work you need to be able to measure the times between the leading and trailing edges of the pulses. I have GPIO_WKUP_7 configured to interrupt on both the rising and falling edge of the output from the IR receiver. So the next thing I need to do is have a timer running to time the pulses.

Now I'm reading about the timers available in the mpc5200. In the middle of chapter 7.4 there is a note: Be aware, the intermediate values of the counters are not software readable. I needed to read the values of a free running timer on each interrupt.

This means I can't hook IR up to GPIO_WKUP_7. Instead I have to move it over to TIMER_7. The timer 7 pin is capable of snapshotting the counter value on either edge on the input signal and generating an interrupt on each edge.

So I never needed all of that interrupt demultiplexing code for GPIO_WKUP_7, the timers have their own non-multiplexed interrupts. Maybe someone on LKML will take it from me and run with it.

Now I have to warm up my soldering iron and move the IR input over to pin 15A in the Phytex patchfield. Then I have to write a whole new device driver for the timer. Hopefully the timer pin will have the features needed to decode IR signals.

BTW, it is many times easier to decode IR signal using a serial port. You set the serial port to a high baud rate and use it as a 1 bit digitizer to record the IR signal. The is the most common method used by LIRC. Too bad all of our serial ports are tied up with other things.

SDHC high capacity flash working

Checked out an 8GB SDHC card and it is working without issue.

(06:42:36 PM) jonsmirl: root@phyCORE-MPC5200B-tiny:~ df -h
Filesystem Size Used Available Use% Mounted on
none 30.0M 0 30.0M 0% /tmp
none 30.0M 20.0k 29.9M 0% /var/log
none 30.0M 16.0k 29.9M 0% /var/run
none 30.0M 0 30.0M 0% /var/lock
tmpfs 30.0M 8.0k 30.0M 0% /dev
/dev/mmcblk0p1 7.6G 32.0k 7.6G 0% /mnt

mmc0: host does not support reading read-only switch. assuming write-enable.
mmc0: new SDHC card on SPI
mmcblk0: mmc0:0000 SD08G 8003584KiB
mmcblk0: p1

Formatting it FAT32 (for compatibility) eats 400MB.
I bought the card for $21 shipped.

Typical home would use 6-10 Digispeakers, that's 80GB storage capacity. All of it fast and silent. 16GB ($48) cards work too. I see a 32GB one for $130 now.

The cards are user installable. In three years 32GB cards will be $20. Prices on these cards are going way down due to their use in camcorders.

I'm still sorting out the interrupt handlers for IR. I hope to get it working soon.

Syndicate content