https://elinux.org/api.php?action=feedcontributions&user=Ichiro&feedformat=atomeLinux.org - User contributions [en]2024-03-29T08:08:19ZUser contributionsMediaWiki 1.31.0https://elinux.org/index.php?title=BeagleBoardOpenOCD&diff=14341BeagleBoardOpenOCD2009-10-22T15:30:06Z<p>Ichiro: /* Build OpenOCD */</p>
<hr />
<div>[[Category: Linux]]<br />
[[Category: OMAP]]<br />
[[Category:Development Boards]]<br />
[[Category: BeagleBoard]]<br />
This page is about how to use open source [http://openocd.berlios.de/web/ OpenOCD] [http://en.wikipedia.org/wiki/JTAG JTAG] software with [[BeagleBoard|BeagleBoard]]. With this, it will be possible to have OMAP3 JTAG debug using cheap [[BeagleBoardJTAG|JTAG hardware]], e.g. [[BeagleBoardJTAG#TinCanTools_Flyswatter|Flyswatter]].<br />
<br />
'''As of September 2009, OpenOCD has basic support for OMAP3 and [[BeagleBoardOpenOCD#Cortex_A8_support|ARM Cortex A8]] on Beagle Board. Cortex A8 support is in early alpha stage, a lot is still missing. But e.g. processor halt, resume, step, breakpoints and ARM disassembly of non-Cache and non-MMU (e.g. U-Boot) applications seem to work.<br />
<br />
Status:<br />
<br />
* You need at least OpenOCD revision '''2770''' ([[BeagleBoardOpenOCD#Build_OpenOCD|using svn]]). With this revision you will have basic access to OMAP3 and Cortex A8 can be basically controlled. This does mean, that OpenOCD is able to configure scan chain correctly to [[OMAP3530_ICEPICK#ICEPICK_infos|access ARM TAP]] ("JTAG controller"), explore CoreSight AccessPoints and halt, resume, step, breakpoints and ARM disassembly on Cortex A8.<br />
* Recent status as of '''September 2009''':<br />
** OpenOCD >= 2770 can and halt, resume, step, breakpoints and ARM disassembly Cortex A8 (ARM) processor on Beagle.<br />
** This works for non-MMU and non-Cache applications (e.g U-Boot).<br />
** [https://lists.berlios.de/pipermail/openocd-development/2009-August/010184.html Linux debugging doesn't work yet].<br />
<br />
<br />
=Hardware=<br />
<br />
To be able to use OpenOCD with OMAP3 based BeagleBoard, make sure that your JTAG Dongle supports:<br />
<br />
* 1.8V devices. Many JTAG dongles are 3.3V only! '''Verify that your dongle supports 1.8V!''' Else the dongle will overpowering the input to OMAP3 and may cause damage.<br />
* Your JTAG dongle is able to switch [[BeagleBoardJTAG#Beagle_JTAG_connection|EMU0 & EMU1 pins high]].<br />
<br />
Flyswatter dongle supports both requirements. If you use [http://tincantools.com/product.php?productid=16144 BeagleBoard Adapter Kit] with [[BeagleBoardJTAG#TinCanTools_Flyswatter|Flyswatter]], make sure you plug the JTAG adapter the correct way. There are several possible ways, though. See [http://www.tincantools.com/images/D/Fly%2BBeagle-800x391.JPG?1229714946602 connection picture] how to do it the right way. In contrast to the picture EMU0 & EMU1 jumpers at JTAG adapter should be both at 1-2 position (touching J2).<br />
<br />
=Build OpenOCD=<br />
<br />
[http://openfacts.berlios.de/index-en.phtml?title=Building_OpenOCD OpenOCD build instructions] describe how to build [http://openocd.berlios.de/web/ OpenOCD]. For questions you can use [https://lists.berlios.de/mailman/listinfo/openocd-development OpenOCD Mailing list].<br />
<br />
Get OpenOCD code via git:<br />
<br />
> git clone git://openocd.git.sourceforge.net/gitroot/openocd/openocd<br />
<br />
For Flyswatter you additionally need [http://www.ftdichip.com/Drivers/D2XX.htm libftd2xx] or [http://www.intra2net.com/de/produkte/opensource/ftdi/ libFTDI]. While libFTDI is available in source, libftd2xx is supposed to be 50% [http://www.beagleboard.org/irclogs/index.php?date=2008-10-16#T16:06:22 faster] than libFTDI. The libtfd2xx binaries are available booth as shared library or linkable archive.<br />
<br />
If you downloaded OpenOCD svn and have libftd2xx or libFTDI, build OpenOCD (assuming you extracted/built FTDI library already):<br />
<br />
> cd openocd<br />
> ./bootstrap<br />
> ./configure --enable-ft2232_ftd2xx --with-ftd2xx-linux-tardir=<path_to>/libftd2xx0.4.16 --prefix=/home/user/bin/openOCD<br />
''or'' (depending which FTDI library you use, see above)<br />
> ./configure --enable-ft2232_libftdi --prefix=/home/user/bin/openOCD<br />
> make<br />
> make install<br />
<br />
When compiling the doc directory You get an error:<br />
openocd.texi:12: @include `version.texi': No such file or directory.<br />
It is possible to avoid by making version.texi. <br />
<br />
> cat doc/version.texi<br />
@set UPDATED 20 January 2009<br />
@set UPDATED-MONTH January 2009<br />
@set EDITION 0.1.0<br />
@set VERSION 0.1.0<br />
<br />
'''Note''': By default (make & make install) only .info documentation is installed. You can get PDF or HTML documentation by<br />
<br />
make pdf<br />
<br />
or<br />
<br />
make html<br />
<br />
Resulting documentation can be found in openocd/doc, then.<br />
<br />
'''Note''': If you like to save some disk space and don't plan to debug OpenOCD binary itself, you can strip this (remove unneeded debug symbols):<br />
<br />
> cd <openocd_install_dir>/bin<br />
> strip openocd<br />
<br />
(e.g. with OpenOCD 1.0 this reduced binary size from ~3MB to ~700kB)<br />
<br />
'''Note''': If you don't have libftdi in standard path, you might like to extend library search path:<br />
<br />
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<path_to>/lib<br />
<br />
if you e.g. get<br />
<br />
> ./openocd<br />
./openocd: error while loading shared libraries: libftdi.so.1: cannot open shared object file: No such file or directory<br />
<br />
=Starting OpenOCD=<br />
<br />
OpenOCD runtime is controlled by several [http://openocd.berlios.de/doc/html/index.html#toc_Config-File-Guidelines configuration files]. OpenOCD comes with basic configuration files for BeagleBoard (''board/ti_beagleboard.cfg'') and OMAP3 (''target/omap3530.cfg'').<br />
<br />
Assuming that you use Flyswatter and it is switched on (attached to USB), you can now start OpenOCD with:<br />
<br />
openocd -s <path_to_config_files> // e.g. <path_of_openocd_install_dir>/lib/openocd<br />
-f <path_to_jtag_interface><br />
-f <path_to_beagle_config><br />
<br />
This should result in<br />
<br />
> '''openocd -s lib/openocd/ -f interface/flyswatter.cfg -f board/ti_beagleboard.cfg'''<br />
Open On-Chip Debugger 0.3.0-in-development (2009-09-29-16:28) svn:2770<br />
$URL: svn://svn.berlios.de/openocd/trunk/src/openocd.c $<br />
For bug reports, read http://svn.berlios.de/svnroot/repos/openocd/trunk/BUGS<br />
RCLK - adaptive <br />
Warn : huge IR length 38 <br />
Info : RCLK (adaptive clock speed) not supported - fallback to 6000 kHz<br />
Info : JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
<br />
This shows that your (Flyswatter) JTAG dongle basically works and that you are able to see OMAP3 JRC. OpenOCD now runs as deamon.<br />
<br />
=Controlling OpenOCD=<br />
<br />
Once OpenOCD runs as [http://openocd.berlios.de/doc/html/Running.html#Running daemon] like above, you can connect using ''telnet'' or ''GDB''<br />
<br />
==telnet==<br />
<br />
Connect to OpenOCD daemon. Assuming you do it on your local machine, open a second terminal window and do (assuming port 4444 as configured in above openocd.cfg):<br />
<br />
> '''telnet localhost 4444'''<br />
Trying 127.0.0.1...<br />
Connected to localhost.<br />
Escape character is '^]'.<br />
Open On-Chip Debugger<br />
> <br />
<br />
This should give you<br />
<br />
Info: accepting 'telnet' connection from 0<br />
<br />
in window where OpenOCD daemon is started.<br />
<br />
At OpenOCDs telnet prompt you can now issue OpenOCD commands. E.g. ''help'' should result in<br />
<br />
> '''help''' <br />
bp list or set breakpoint [<address> <length> [hw]]<br />
cpu <name> - prints out target options and a comment <br />
on CPU which matches name <br />
debug_level adjust debug level <0-3> <br />
drscan execute DR scan <device> <num_bits> <value> <br />
<num_bits1> <value2> ... <br />
dump_image dump_image <file> <address> <size> <br />
exit exit telnet session <br />
fast fast <enable/disable> - place at beginning of <br />
config files. Sets defaults to fast and dangerous.<br />
<br />
fast_load loads active fast load image to current target - <br />
mainly for profiling purposes <br />
fast_load_image same args as load_image, image stored in memory - <br />
mainly for profiling purposes <br />
find <file> - print full path to file according to <br />
OpenOCD search rules <br />
flush_count returns number of times the JTAG queue has been <br />
flushed <br />
ft2232_device_desc the USB device description of the FTDI FT2232 <br />
device <br />
ft2232_latency set the FT2232 latency timer to a new value <br />
ft2232_layout the layout of the FT2232 GPIO signals used to <br />
control output-enables and reset signals <br />
ft2232_serial the serial number of the FTDI FT2232 device <br />
ft2232_vid_pid the vendor ID and product ID of the FTDI FT2232 <br />
device <br />
gdb_breakpoint_override hard/soft/disable - force breakpoint type for gdb <br />
'break' commands. <br />
gdb_detach resume/reset/halt/nothing - specify behavior when <br />
GDB detaches from the target <br />
gdb_flash_program enable or disable flash program <br />
gdb_memory_map enable or disable memory map <br />
gdb_port daemon configuration command gdb_port <br />
gdb_report_data_abort enable or disable reporting data aborts <br />
halt halt target <br />
help Tcl implementation of help command <br />
init initializes target and servers - nop on subsequent <br />
invocations <br />
interface try to configure interface <br />
interface_list list all built-in interfaces <br />
irscan execute IR scan <device> <instr> [dev2] [instr2] <br />
... <br />
jtag perform jtag tap actions <br />
jtag_device (DEPRECATED) jtag_device <ir_length> <ir_expected> <br />
<ir_mask> <br />
jtag_khz set maximum jtag speed (if supported); parameter <br />
is maximum khz, or 0 for adaptive clocking (RTCK). <br />
<br />
jtag_nsrst_delay jtag_nsrst_delay <ms> - delay after deasserting <br />
srst in ms <br />
jtag_ntrst_delay jtag_ntrst_delay <ms> - delay after deasserting <br />
trst in ms <br />
jtag_rclk fallback_speed_khz - set JTAG speed to RCLK or use <br />
fallback speed <br />
jtag_reset toggle reset lines <trst> <srst> <br />
jtag_speed (DEPRECATED) set jtag speed (if supported) <br />
load_image load_image <file> <address> <br />
['bin'|'ihex'|'elf'|'s19'] [min_address] <br />
[max_length] <br />
log_output redirect logging to <file> (default: stderr) <br />
mdb display memory bytes <addr> [count] <br />
mdh display memory half-words <addr> [count] <br />
mdw display memory words <addr> [count] <br />
mwb write memory byte <addr> <value> [count] <br />
mwh write memory half-word <addr> <value> [count] <br />
mww write memory word <addr> <value> [count] <br />
ocd_array2mem convert a TCL array to memory locations and write <br />
the values <ARRAYNAME> <WIDTH = 32/16/8> <br />
<ADDRESS> <COUNT> <br />
ocd_flash_banks return information about the flash banks <br />
ocd_mem2array read memory and return as a TCL array for script <br />
processing <ARRAYNAME> <WIDTH = 32/16/8> <ADDRESS> <br />
<COUNT> <br />
pathmove move JTAG to state1 then to state2, state3, etc. <br />
<state1>,<state2>,<stat3>... <br />
poll poll target state <br />
power_restore Overridable procedure run when power restore is <br />
detected. Runs 'reset init' by default. <br />
production <serialnumber> - Runs production procedure. Throws <br />
exception if procedure failed. Prints progress <br />
messages. Implement this procedure in the target <br />
script. <br />
production Runs test procedure. Throws exception if procedure <br />
failed. Prints progress messages. Implement in <br />
target script. <br />
production_info Displays information on production procedure for <br />
target script. Implement this procedure in target <br />
script. <br />
profile profiling samples the CPU PC <br />
rbp remove breakpoint <address> <br />
reg display or set a register <br />
reset reset target [run | halt | init] - default is run <br />
reset_config [none/trst_only/srst_only/trst_and_srst] <br />
[srst_pulls_trst/trst_pulls_srst] <br />
[combined/separate] <br />
[trst_push_pull/trst_open_drain] <br />
[srst_push_pull/srst_open_drain] <br />
resume resume target [addr] <br />
runtest move to Run-Test/Idle, and execute <num_cycles> <br />
rwp remove watchpoint <address> <br />
scan_chain print current scan chain configuration <br />
script <filename> - filename of OpenOCD script (tcl) to <br />
run <br />
shutdown shut the server down <br />
sleep <n> [busy] - sleep for n milliseconds. "busy" <br />
means busy wait <br />
soft_reset_halt halt the target and do a soft reset <br />
srst_deasserted Overridable procedure run when srst deassert is <br />
detected. Runs 'reset init' by default. <br />
step step one instruction from current PC or [addr] <br />
svf run svf <file> <br />
target configure target <br />
targets change the current command line target (one <br />
parameter) or lists targets (with no parameter) <br />
tcl_port port on which to listen for incoming TCL syntax <br />
telnet_port port on which to listen for incoming telnet <br />
connections <br />
test_image test_image <file> [offset] [type] <br />
tms_sequence choose short(default) or long tms_sequence <short <br />
| long> <br />
verify_image verify_image <file> [offset] [type] <br />
verify_ircapture verify value captured during Capture-IR <enable |<br />
disable><br />
verify_jtag verify value capture <enable | disable><br />
version show OpenOCD version<br />
virt2phys translate a virtual address into a physical<br />
address<br />
wait_halt wait for target halt [time (s)]<br />
wp list or set watchpoint [<address> <length> <r/w/a><br />
[value] [mask]]<br />
xsvf run xsvf <file> [virt2] [quiet]<br />
armv4_5 core_state display/change ARM core state <arm | thumb><br />
armv4_5 disassemble disassemble instructions <address> [<count><br />
['thumb']]<br />
armv4_5 reg display ARM core registers<br />
cortex_a8 cache_info display information about target caches<br />
dap apid return id reg from AP [num], default currently<br />
selected AP<br />
dap apsel select a different AP [num] (default 0)<br />
dap baseaddr return debug base address from AP [num], default<br />
currently selected AP<br />
dap info dap info for ap [num], default currently selected<br />
AP<br />
dap memaccess set/get number of extra tck for mem-ap memory bus<br />
access [0-255]<br />
flash bank flash bank <driver> <base> <size> <chip_width><br />
<bus_width> <target> [driver_options ...]<br />
mflash bank mflash bank <soc> <base> <RST pin> <target #><br />
nand device<br />
pld device<br />
target_request debugmsgs enable/disable reception of debug messages from<br />
target<br />
trace history display trace history, ['clear'] history or set<br />
[size]<br />
trace point display trace points, ['clear'] list of trace<br />
points, or add new tracepoint at [address]<br />
<br />
==Example session==<br />
<br />
Now, we can try to basically halt and resume OMAP3 (assuming U-Boot is running at U-Boot's prompt):<br />
<br />
> '''omap3_dbginit'''<br />
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
JTAG Tap/device matched<br />
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080<br />
SWJ-DP STICKY ERROR<br />
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080<br />
TargetName Type Endian TapName State<br />
-- ------------------ ---------- ------ ------------------ ------------<br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown<br />
0x54011314 00000003 ....<br />
0x54011314 00000001 ....<br />
<br />
> '''scan_chain'''<br />
TapName | Enabled | IdCode Expected IrLen IrCap IrMask Instr<br />
---|--------------------|---------|------------|------------|------|------|------|---------<br />
0 | omap3530.dsp | n | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff<br />
1 | omap3530.dap | Y | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a<br />
2 | omap3530.jrc | Y | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f<br />
<br />
> '''halt'''<br />
target state: halted<br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e87dcc<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''poll'''<br />
background polling: on<br />
TAP: omap3530.dap (enabled)<br />
target state: halted<br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e87dcc<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''resume'''<br />
<br />
> '''poll'''<br />
background polling: on<br />
TAP: omap3530.dap (enabled)<br />
target state: running<br />
<br />
> '''soft_reset_halt'''<br />
requesting target halt and executing a soft reset<br />
Target omap3.cpu does not support soft_reset_halt<br />
<br />
> '''cortex_a8 cache_info'''<br />
cache type: 0x0, unified cache<br />
D-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400<br />
I-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400<br />
<br />
> '''halt''' <br />
target state: halted <br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e88158<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''armv4_5 disassemble 0x80e88158 10'''<br />
0x80e88158 0xe3130001 TST r3, #0x1<br />
0x80e8815c 0x0afffffc BEQ 0x80e88154<br />
0x80e88160 0xe5d00000 LDRB r0, [r0]<br />
0x80e88164 0xe12fff1e BX r14<br />
0x80e88168 0xe5d00014 LDRB r0, [r0, #0x14]<br />
0x80e8816c 0xe2000001 AND r0, r0, #0x1<br />
0x80e88170 0xe12fff1e BX r14<br />
0x80e88174 0xe1a02001 MOV r2, r1<br />
0x80e88178 0xe1a01000 MOV r1, r0<br />
0x80e8817c 0xe59f0000 LDR r0, [r15]<br />
<br />
> '''step'''<br />
target state: halted<br />
target halted in ARM state due to breakpoint, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e8815c<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''step'''<br />
target state: halted<br />
target halted in ARM state due to breakpoint, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e88154<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''bp 0x80e88160 4 hw'''<br />
breakpoint set at 0x80e88160<br />
<br />
> '''resume'''<br />
<br />
''... type anything in U-Boot until breakpoint is hit ...''<br />
<br />
target state: halted<br />
target halted in ARM state due to breakpoint, current mode: Supervisor<br />
spsr_svc: 0x000001d3 pc: 0x80e88160<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''bp'''<br />
0x80e88160, 0x4, 1<br />
<br />
> '''rbp 0x80e88160'''<br />
<br />
> '''resume'''<br />
<br />
=GDB ARM=<br />
<br />
To [[DebuggingTheLinuxKernelUsingGdb|debug]] an ARM target with GNU debugger ([[GDB|GDB]]), you need a GDB understanding ARM processor. If your ARM cross compilation tool chain doesn't include a GDB, you can easily build it your self.<br />
<br />
==Build==<br />
<br />
* Download latest [http://www.gnu.org/software/gdb/download/ GDB sources]. [http://openocd.berlios.de/doc/GDB-and-OpenOCD.html#GDB-and-OpenOCD OpenOCD docu] recommends to use GDB 6.7 or newer. Here, we use GDB 6.8 which is the recent version while writing this.<br />
<br />
* Extract, configure and build GDB for ARM. Afterwards remove temporary stuff. Options are:<br />
** <path_where_ARM_gdb_shall_be_installed_to> : Directory where you want to install the resulting tool to. E.g. /home/user/arm-gdb/<br />
** <ARM_toolchain_prefix> : The prefix of your ARM GCC toolchain, e.g. ''arm-linux'' or ''arm-none-linux-gnueabi'' ([[BeagleBoard#Cortex_A8_ARM|CodeSourcery tool chain]]).<br />
<br />
> tar xfj gdb-6.8.tar.bz2<br />
> mkdir build-gdb<br />
> cd build-gdb/<br />
build-gdb > ../gdb-6.8/configure --prefix=<path_where_ARM_gdb_shall_be_installed_to> --target=<ARM_toolchain_prefix> i686-pc-linux-gnu<br />
build-gdb > make -j4<br />
build-gdb > make install<br />
build-gdb > cd ..<br />
> rm -rf gdb-6.8 build-gdb<br />
> export PATH=$PATH:<path_where_ARM_gdb_shall_be_installed_to>/bin<br />
<br />
Test:<br />
<br />
bin> ./arm-none-linux-gnueabi-gdb<br />
GNU gdb 6.8<br />
Copyright (C) 2008 Free Software Foundation, Inc.<br />
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br />
This is free software: you are free to change and redistribute it.<br />
There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br />
and "show warranty" for details.<br />
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".<br />
(gdb)<br />
<br />
==Example session==<br />
<br />
To use gdb, you have to connect to running OpenOCD using remote command. E.g.:<br />
<br />
> '''arm-none-linux-gnueabi-gdb'''<br />
GNU gdb 6.8<br />
Copyright (C) 2008 Free Software Foundation, Inc.<br />
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br />
This is free software: you are free to change and redistribute it.<br />
There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br />
and "show warranty" for details.<br />
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".<br />
<br />
(gdb) '''target remote localhost:3333'''<br />
Remote debugging using localhost:3333<br />
0x00000000 in ?? () <br />
(gdb) '''monitor omap3_dbginit''' <br />
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080 <br />
SWJ-DP STICKY ERROR <br />
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080 <br />
TargetName Type Endian TapName State <br />
-- ------------------ ---------- ------ ------------------ ------------ <br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown <br />
0x54011314 00000003 .... <br />
0x54011314 00000001 .... <br />
<br />
(gdb) '''monitor scan_chain''' <br />
TapName | Enabled | IdCode Expected IrLen IrCap IrMask Instr <br />
---|--------------------|---------|------------|------------|------|------|------|--------- <br />
0 | omap3530.dsp | n | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff<br />
1 | omap3530.dap | Y | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a <br />
2 | omap3530.jrc | Y | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f<br />
<br />
(gdb) '''info registers'''<br />
r0 0x0 0<br />
r1 0x60a 1546<br />
r2 0x80000100 2147483904<br />
r3 0x706 1798 <br />
r4 0xc00081b8 3221258680<br />
r5 0x0 0 <br />
r6 0x80026960 2147641696<br />
r7 0xc00081b8 3221258680<br />
r8 0x0 0 <br />
r9 0x411fc082 1092599938<br />
r10 0x800268f8 2147641592<br />
r11 0xf731c8f9 4147235065<br />
r12 0x80796ae0 2155440864<br />
sp 0x8051a900 0x8051a900<br />
lr 0x80008018 2147516440<br />
pc 0x8000815c 0x8000815c<br />
fps 0x0 0 <br />
cpsr 0x0 0 <br />
<br />
(gdb) '''p/x $pc''' <br />
$2 = 0x8000815c <br />
<br />
(gdb) '''x/i $pc''' <br />
0x8000815c: nop (mov r0,r0)<br />
<br />
(gdb) '''x'''<br />
0x80008160: b 0x8000815c<br />
<br />
==LED blink example==<br />
<br />
Magnus Lundin has a simple standalone LED blink test program which can be used for tests.<br />
<br />
* [http://github.com/mlu/cortal_dendrites/tree/6ed04b7e838981f594eb6b701a17c220fff952dd/cortex_a8/standalone/LEDblink LED blink] test program.<br />
* [http://github.com/mlu/cortal_dendrites/blob/6ed04b7e838981f594eb6b701a17c220fff952dd/cortex_a8/standalone/LEDblink/README README]<br />
* Example .gdbinit file:<br />
<br />
echo *** Executing .gdbint to set up the environment for debugging gdb:\n<br />
<br />
# This connects to OpenOcd at localhost:3333<br />
target remote localhost:3333<br />
<br />
# omap3_dbginit must be run in OpenOCD after every reset<br />
monitor omap3_dbginit<br />
<br />
# Stop core<br />
monitor halt<br />
<br />
echo *** Environment ready, now load and start executeable:\n<br />
<br />
# Load the program executable called "LEDblink"<br />
load LEDblink<br />
<br />
# Load the symbols for the program.<br />
symbol-file LEDblink<br />
<br />
# Set a breakpoint at main().<br />
b main<br />
<br />
# Run to the breakpoint.<br />
cont<br />
<br />
Clone the code by git, goto ''cortex_a8/standalone/LEDblink'' directory, build the example using provided Makefile and then in that directory start gdb (so that above .gdbinit is executed):<br />
<br />
> '''arm-none-linux-gnueabi-gdb'''<br />
GNU gdb 6.8<br />
Copyright (C) 2008 Free Software Foundation, Inc.<br />
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br />
This is free software: you are free to change and redistribute it.<br />
There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br />
and "show warranty" for details.<br />
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".<br />
*** Executing .gdbint to set up the environment for debugging gdb:<br />
0x00000000 in ?? ()<br />
The target may not be able to correctly handle a memory-write-packet-size<br />
of 1024 bytes. Change the packet size? (y or n) [answered Y; input not from terminal]<br />
TargetName Type Endian TapName State<br />
-- ------------------ ---------- ------ ------------------ ------------<br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown<br />
target state: halted<br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x600001d3 pc: 0x80008160<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
*** Environment ready, now load and start executeable:<br />
Loading section .text, size 0xe0 lma 0x82000000<br />
Start address 0x82000000, load size 224<br />
Transfer rate: 4 KB/sec, 224 bytes/write.<br />
Current language: auto; currently asm<br />
Breakpoint 1 at 0x8200003c: file LEDblink.c, line 22.<br />
<br />
Breakpoint 1, main () at LEDblink.c:22<br />
22 LEDbrightness++;<br />
Current language: auto; currently c<br />
<br />
(gdb) '''cont'''<br />
<br />
This should let Beagle's LEDs blink.<br />
<br />
=Development internals=<br />
<br />
The sections below give some datails if you are interested in developing OpenOCD for OMAP3 and Cortex A8 used on Beagle. If you like to help to improve OpenOCD support for Beagle, this might help you.<br />
<br />
==Introduction==<br />
<br />
Magnus Lundin wrote a very nice [http://arttools.blogspot.com/2009/09/debugging-on-cortex-a8-system.html introduction] on the basic Cortex A8 (OMAP3) debug architecture.<br />
<br />
==Cortex A8 support==<br />
<br />
As mentioned above, OpenOCD has initial experimental Cortex A8 support. Rick Altherr wrote (thanks!) a [https://lists.berlios.de/pipermail/openocd-development/2009-April/005273.html nice intro] how to help with Cortex A8 support for OpenOCD:<br />
<br />
''The [http://svn.berlios.de/svnroot/repos/openocd/trunk/src/target/cortex_m3.c Cortex-M3 support] is very similar to Cortex-A8 up to a certain layer. The ARM debug interface is designed as a set of layers that build on each other and can do automatic discovery. The [http://svn.berlios.de/svnroot/repos/openocd/trunk/src/target/cortex_swjdp.c cortex-swjdp] support in OpenOCD is a good start, but it assumes which AHB and APB ports are available. The first item would be to verify the cortex-swjdp portion against the documents for the CoreSight debug interface.''<br />
<br />
''To really get started, familiarize yourself with the following docs:''<br />
* ''[http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ihi0031a/index.html ARM IHI 0031A] (ARM Debug Interface v5)'' - only available to registered ARM customers<br />
* ''[http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ihi0029b/index.html ARM IHI 0029B] (CoreSight v1.0)'' - only available to registered ARM customers<br />
* ''[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0316d/DDI0316D_dap_lite_trm.pdf ARM DDI 0316D] (CoreSight DAP-Lite)''<br />
* ''[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0314f/DDI0314F_coresight_component_trm.pdf ARM DDI 0314F] (CoreSight Components TRM)''<br />
* ''[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf ARM DDI 0344H] (Cortex-A8 TRM, primarily chapter 12)''<br />
<br />
''These should be listed in the right order for getting up to speed. Basically the Cortex-A8 debug registers are accessed externally via CoreSight. CoreSight is an implementation of the ARM Debug Interface v5.''<br />
<br />
''The cortex-swjdp implementation in OpenOCD deals with CoreSight but makes some assumptions about which CoreSight components are available. For Cortex-A8, that will likely need to change a bit as the set of components will be different.''<br />
<br />
''After cortex-swjdp is patched to handle the new components, a cortex-a8 target implementation can be started by using the cortex-swjdp layer to access the various debug registers and memory locations.''<br />
<br />
For discussion about this, see [https://lists.berlios.de/pipermail/openocd-development/2009-March/005097.html mail #1], [https://lists.berlios.de/pipermail/openocd-development/2009-March/005099.html mail #2] and [https://lists.berlios.de/pipermail/openocd-development/2009-March/005117.html mail #3].<br />
<br />
Note: With revision ~1570 the cortex-swjdp module in OpenOCD has been renamed to arm_adi_v5 and updated to remove all dependencies on Cortex-M3 specific features and as far as possible only use the ARM Debug Interface v5 features. The Cortex-M3 specifics has been moved to cortex_m3 module. This is a step in preparing OpenOCD for full Cortex-A8 support. <br />
<br />
Using recent OpenOCD versions, you can examine CoreSight APs: <br />
<br />
<pre><br />
> version <br />
Open On-Chip Debugger 0.3.0-in-development (2009-08-30-19:54) svn:2643M<br />
<br />
> omap3_dbginit<br />
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
JTAG Tap/device matched<br />
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080<br />
SWJ-DP STICKY ERROR<br />
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080<br />
TargetName Type Endian TapName State<br />
-- ------------------ ---------- ------ ------------------ ------------<br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown<br />
0x54011314 00000003 ....<br />
0x54011314 00000001 ....<br />
<br />
> scan_chain<br />
TapName | Enabled | IdCode Expected IrLen IrCap IrMask Instr<br />
---|--------------------|---------|------------|------------|------|------|------|---------<br />
0 | omap3530.dsp | n | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff<br />
1 | omap3530.dap | Y | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a<br />
2 | omap3530.jrc | Y | 0x00000000 | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f<br />
<br />
> dap apsel 0<br />
ap 0 selected, identification register 0x14770001<br />
<br />
> dap info 0<br />
ap identification register 0x14770001<br />
Type is mem-ap AHB <br />
ap debugbase 0xffffffff <br />
No ROM table present <br />
<br />
> dap info 1<br />
ap identification register 0x04770002<br />
Type is mem-ap APB <br />
ap debugbase 0x80000000 <br />
ROM table in legacy format<br />
CID3 0xb1, CID2 0x5, CID1 0x10, CID0, 0xd<br />
MEMTYPE system memory not present. Dedicated debug bus<br />
ROMTABLE[0x0] = 0xd4010003 <br />
Component base address 0x54010000, pid4 0x4, start address 0x54010000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21 <br />
ROMTABLE[0x4] = 0xd4011003 <br />
Component base address 0x54011000, pid4 0x4, start address 0x54011000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8 <br />
ROMTABLE[0x8] = 0xd4012003 <br />
Component base address 0x54012000, pid4 0x0, start address 0x54012000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13 <br />
ROMTABLE[0xc] = 0xd4013002 <br />
Component not present <br />
ROMTABLE[0x10] = 0xd4019003 <br />
Component base address 0x54019000, pid4 0x4, start address 0x54019000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12 <br />
ROMTABLE[0x14] = 0xd401b003 <br />
Component base address 0x5401b000, pid4 0x4, start address 0x5401b000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7 <br />
ROMTABLE[0x18] = 0xd401d003 <br />
Component base address 0x5401d000, pid4 0x0, start address 0x5401d000<br />
Component cid1 0xf0, class is Non standard layout<br />
CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd<br />
PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43<br />
ROMTABLE[0x1c] = 0xd4500003<br />
Component base address 0x54500000, pid4 0x0, start address 0x54500000<br />
Component cid1 0x90, class is CoreSight component<br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd<br />
PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20<br />
ROMTABLE[0x20] = 0x0<br />
End of ROM table<br />
<br />
> dap apsel 1<br />
ap 1 selected, identification register 0x04770002<br />
<br />
> dap apsel 2<br />
ap 2 selected, identification register 0x14760010<br />
<br />
> dap info 2<br />
ap identification register 0x14760010<br />
Type is jtag-ap<br />
ap debugbase 0x00000000<br />
No ROM table present<br />
<br />
> dap apsel 3<br />
ap 3 selected, identification register 0x00000000<br />
<br />
> dap info 3<br />
ap identification register 0x00000000<br />
No AP found at this apsel 0x3<br />
No ROM table present<br />
<br />
><br />
</pre><br />
<br />
==ROMTable==<br />
<br />
To interpret content of above ROMTable, have a look to<br />
<br />
* [http://www.ti.com/litv/pdf/spruf98b OMAP35x Technical Reference Manual (Rev. B)] (spruf98b.pdf, 39622 Kbytes), Table 5-105<br />
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0314f/DDI0314F_coresight_component_trm.pdf CoreSight Components TRM] (ARM DDI 0314F), Table 2-3<br />
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM] (ARM DDI 0344H)<br />
<br />
With this, we get (first three entries are in the MPU SS Module, address range 0x54010000 - 0x54018000, part number is given by PID1[3-0] and PID0[7-0]):<br />
<br />
ROMTABLE[0x0] = 0xd4010003 <br />
Component base address 0x54010000, pid4 0x4, start address 0x54010000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21<br />
<br />
* Part number is 0x921: ETM module. See [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM] chapter 14.<br />
<br />
ROMTABLE[0x4] = 0xd4011003 <br />
Component base address 0x54011000, pid4 0x4, start address 0x54011000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8 <br />
<br />
* Part number is 0xC08: This is the [[BeagleBoardOpenOCD#Debug_Register_Interface|Debug Register Interface]]. See table 12-3 in the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM].<br />
<br />
ROMTABLE[0x8] = 0xd4012003 <br />
Component base address 0x54012000, pid4 0x0, start address 0x54012000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13 <br />
<br />
* Part number 0x113: This is ????<br />
<br />
ROMTABLE[0x10] = 0xd4019003 <br />
Component base address 0x54019000, pid4 0x4, start address 0x54019000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12 <br />
<br />
* Part number 0x912: TPIU Module. <br />
<br />
ROMTABLE[0x14] = 0xd401b003 <br />
Component base address 0x5401b000, pid4 0x4, start address 0x5401b000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7 <br />
<br />
* Part number 0x907: ETB Module.<br />
<br />
ROMTABLE[0x18] = 0xd401d003 <br />
Component base address 0x5401d000, pid4 0x0, start address 0x5401d000<br />
Component cid1 0xf0, class is Non standard layout<br />
CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd<br />
PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43<br />
<br />
* Part number 0x343: DAP CTL Module.<br />
<br />
ROMTABLE[0x1c] = 0xd4500003<br />
Component base address 0x54500000, pid4 0x0, start address 0x54500000<br />
Component cid1 0x90, class is CoreSight component<br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd<br />
PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20<br />
<br />
* Part number 0x120: SDTI Module.<br />
<br />
==Debug Register Interface==<br />
<br />
With above info about debug register interface and table 12-3 in the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM] we are able to access this interface using OpenOCDs ''mdw'' command:<br />
<br />
> omap3.cpu mdw 0x54011000<br />
0x54011000 15141012<br />
<br />
This is the debug ID register. See table 12-11 of [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM]:<br />
<br />
{|border=1<br />
!Bits<br />
!Field<br />
!Value & Function<br />
|-<br />
|[31-28]<br />
|WRP<br />
|0x1 -> 2 WRPs are implemented<br />
|-<br />
|[27-24]<br />
|BRP<br />
|0x5 -> 6 BRPs are implemented<br />
|-<br />
|[23-20]<br />
|Context<br />
|0x1 -> 2 BRPs have context ID capability<br />
|-<br />
|[19-16]<br />
|Debug architecture version<br />
|0x4 -> ARMv7 debug<br />
|-<br />
|[12]<br />
|security<br />
|0x1 -> Security extensions implemented<br />
|-<br />
|[7-4]<br />
|variant<br />
|0x1<br />
|-<br />
|[3-0]<br />
|revision<br />
|0x2 <br />
|-<br />
|}<br />
<br />
> omap3.cpu mdw 0x54011FF0<br />
0x54011ff0 0000000d<br />
> omap3.cpu mdw 0x54011FF4<br />
0x54011ff4 00000090<br />
> omap3.cpu mdw 0x54011FF8<br />
0x54011ff8 00000005<br />
> omap3.cpu mdw 0x54011FFC<br />
0x54011ffc 000000b1<br />
<br />
These are the component identification registers. See table 12-51 of [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM].</div>Ichirohttps://elinux.org/index.php?title=BeagleBoardOpenOCD&diff=14339BeagleBoardOpenOCD2009-10-22T15:21:49Z<p>Ichiro: /* Build OpenOCD */</p>
<hr />
<div>[[Category: Linux]]<br />
[[Category: OMAP]]<br />
[[Category:Development Boards]]<br />
[[Category: BeagleBoard]]<br />
This page is about how to use open source [http://openocd.berlios.de/web/ OpenOCD] [http://en.wikipedia.org/wiki/JTAG JTAG] software with [[BeagleBoard|BeagleBoard]]. With this, it will be possible to have OMAP3 JTAG debug using cheap [[BeagleBoardJTAG|JTAG hardware]], e.g. [[BeagleBoardJTAG#TinCanTools_Flyswatter|Flyswatter]].<br />
<br />
'''As of September 2009, OpenOCD has basic support for OMAP3 and [[BeagleBoardOpenOCD#Cortex_A8_support|ARM Cortex A8]] on Beagle Board. Cortex A8 support is in early alpha stage, a lot is still missing. But e.g. processor halt, resume, step, breakpoints and ARM disassembly of non-Cache and non-MMU (e.g. U-Boot) applications seem to work.<br />
<br />
Status:<br />
<br />
* You need at least OpenOCD revision '''2770''' ([[BeagleBoardOpenOCD#Build_OpenOCD|using svn]]). With this revision you will have basic access to OMAP3 and Cortex A8 can be basically controlled. This does mean, that OpenOCD is able to configure scan chain correctly to [[OMAP3530_ICEPICK#ICEPICK_infos|access ARM TAP]] ("JTAG controller"), explore CoreSight AccessPoints and halt, resume, step, breakpoints and ARM disassembly on Cortex A8.<br />
* Recent status as of '''September 2009''':<br />
** OpenOCD >= 2770 can and halt, resume, step, breakpoints and ARM disassembly Cortex A8 (ARM) processor on Beagle.<br />
** This works for non-MMU and non-Cache applications (e.g U-Boot).<br />
** [https://lists.berlios.de/pipermail/openocd-development/2009-August/010184.html Linux debugging doesn't work yet].<br />
<br />
<br />
=Hardware=<br />
<br />
To be able to use OpenOCD with OMAP3 based BeagleBoard, make sure that your JTAG Dongle supports:<br />
<br />
* 1.8V devices. Many JTAG dongles are 3.3V only! '''Verify that your dongle supports 1.8V!''' Else the dongle will overpowering the input to OMAP3 and may cause damage.<br />
* Your JTAG dongle is able to switch [[BeagleBoardJTAG#Beagle_JTAG_connection|EMU0 & EMU1 pins high]].<br />
<br />
Flyswatter dongle supports both requirements. If you use [http://tincantools.com/product.php?productid=16144 BeagleBoard Adapter Kit] with [[BeagleBoardJTAG#TinCanTools_Flyswatter|Flyswatter]], make sure you plug the JTAG adapter the correct way. There are several possible ways, though. See [http://www.tincantools.com/images/D/Fly%2BBeagle-800x391.JPG?1229714946602 connection picture] how to do it the right way. In contrast to the picture EMU0 & EMU1 jumpers at JTAG adapter should be both at 1-2 position (touching J2).<br />
<br />
=Build OpenOCD=<br />
<br />
[http://openfacts.berlios.de/index-en.phtml?title=Building_OpenOCD OpenOCD build instructions] describe how to build [http://openocd.berlios.de/web/ OpenOCD]. For questions you can use [https://lists.berlios.de/mailman/listinfo/openocd-development OpenOCD Mailing list].<br />
<br />
Get OpenOCD code via git:<br />
<br />
> git clone git://openocd.git.sourceforge.net/gitroot/openocd/openocd<br />
<br />
For Flyswatter you additionally need [http://www.ftdichip.com/Drivers/D2XX.htm libftd2xx] or [http://www.intra2net.com/de/produkte/opensource/ftdi/ libFTDI]. While libFTDI is available in source, libftd2xx is supposed to be 50% [http://www.beagleboard.org/irclogs/index.php?date=2008-10-16#T16:06:22 faster] than libFTDI. The libtfd2xx binaries are available booth as shared library or linkable archive.<br />
<br />
If you downloaded OpenOCD svn and have libftd2xx or libFTDI, build OpenOCD (assuming you extracted/built FTDI library already):<br />
<br />
> cd openocd<br />
> ./bootstrap<br />
> ./configure --enable-ft2232_ftd2xx --with-ftd2xx-linux-tardir=<path_to>/libftd2xx0.4.16 --prefix=/home/user/bin/openOCD<br />
''or'' (depending which FTDI library you use, see above)<br />
> ./configure --enable-ft2232_libftdi --prefix=/home/user/bin/openOCD<br />
> make<br />
> make install<br />
<br />
'''Note''': By default (make & make install) only .info documentation is installed. You can get PDF or HTML documentation by<br />
<br />
make pdf<br />
<br />
or<br />
<br />
make html<br />
<br />
Resulting documentation can be found in openocd/doc, then.<br />
<br />
'''Note''': If you like to save some disk space and don't plan to debug OpenOCD binary itself, you can strip this (remove unneeded debug symbols):<br />
<br />
> cd <openocd_install_dir>/bin<br />
> strip openocd<br />
<br />
(e.g. with OpenOCD 1.0 this reduced binary size from ~3MB to ~700kB)<br />
<br />
'''Note''': If you don't have libftdi in standard path, you might like to extend library search path:<br />
<br />
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<path_to>/lib<br />
<br />
if you e.g. get<br />
<br />
> ./openocd<br />
./openocd: error while loading shared libraries: libftdi.so.1: cannot open shared object file: No such file or directory<br />
<br />
=Starting OpenOCD=<br />
<br />
OpenOCD runtime is controlled by several [http://openocd.berlios.de/doc/html/index.html#toc_Config-File-Guidelines configuration files]. OpenOCD comes with basic configuration files for BeagleBoard (''board/ti_beagleboard.cfg'') and OMAP3 (''target/omap3530.cfg'').<br />
<br />
Assuming that you use Flyswatter and it is switched on (attached to USB), you can now start OpenOCD with:<br />
<br />
openocd -s <path_to_config_files> // e.g. <path_of_openocd_install_dir>/lib/openocd<br />
-f <path_to_jtag_interface><br />
-f <path_to_beagle_config><br />
<br />
This should result in<br />
<br />
> '''openocd -s lib/openocd/ -f interface/flyswatter.cfg -f board/ti_beagleboard.cfg'''<br />
Open On-Chip Debugger 0.3.0-in-development (2009-09-29-16:28) svn:2770<br />
$URL: svn://svn.berlios.de/openocd/trunk/src/openocd.c $<br />
For bug reports, read http://svn.berlios.de/svnroot/repos/openocd/trunk/BUGS<br />
RCLK - adaptive <br />
Warn : huge IR length 38 <br />
Info : RCLK (adaptive clock speed) not supported - fallback to 6000 kHz<br />
Info : JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
<br />
This shows that your (Flyswatter) JTAG dongle basically works and that you are able to see OMAP3 JRC. OpenOCD now runs as deamon.<br />
<br />
=Controlling OpenOCD=<br />
<br />
Once OpenOCD runs as [http://openocd.berlios.de/doc/html/Running.html#Running daemon] like above, you can connect using ''telnet'' or ''GDB''<br />
<br />
==telnet==<br />
<br />
Connect to OpenOCD daemon. Assuming you do it on your local machine, open a second terminal window and do (assuming port 4444 as configured in above openocd.cfg):<br />
<br />
> '''telnet localhost 4444'''<br />
Trying 127.0.0.1...<br />
Connected to localhost.<br />
Escape character is '^]'.<br />
Open On-Chip Debugger<br />
> <br />
<br />
This should give you<br />
<br />
Info: accepting 'telnet' connection from 0<br />
<br />
in window where OpenOCD daemon is started.<br />
<br />
At OpenOCDs telnet prompt you can now issue OpenOCD commands. E.g. ''help'' should result in<br />
<br />
> '''help''' <br />
bp list or set breakpoint [<address> <length> [hw]]<br />
cpu <name> - prints out target options and a comment <br />
on CPU which matches name <br />
debug_level adjust debug level <0-3> <br />
drscan execute DR scan <device> <num_bits> <value> <br />
<num_bits1> <value2> ... <br />
dump_image dump_image <file> <address> <size> <br />
exit exit telnet session <br />
fast fast <enable/disable> - place at beginning of <br />
config files. Sets defaults to fast and dangerous.<br />
<br />
fast_load loads active fast load image to current target - <br />
mainly for profiling purposes <br />
fast_load_image same args as load_image, image stored in memory - <br />
mainly for profiling purposes <br />
find <file> - print full path to file according to <br />
OpenOCD search rules <br />
flush_count returns number of times the JTAG queue has been <br />
flushed <br />
ft2232_device_desc the USB device description of the FTDI FT2232 <br />
device <br />
ft2232_latency set the FT2232 latency timer to a new value <br />
ft2232_layout the layout of the FT2232 GPIO signals used to <br />
control output-enables and reset signals <br />
ft2232_serial the serial number of the FTDI FT2232 device <br />
ft2232_vid_pid the vendor ID and product ID of the FTDI FT2232 <br />
device <br />
gdb_breakpoint_override hard/soft/disable - force breakpoint type for gdb <br />
'break' commands. <br />
gdb_detach resume/reset/halt/nothing - specify behavior when <br />
GDB detaches from the target <br />
gdb_flash_program enable or disable flash program <br />
gdb_memory_map enable or disable memory map <br />
gdb_port daemon configuration command gdb_port <br />
gdb_report_data_abort enable or disable reporting data aborts <br />
halt halt target <br />
help Tcl implementation of help command <br />
init initializes target and servers - nop on subsequent <br />
invocations <br />
interface try to configure interface <br />
interface_list list all built-in interfaces <br />
irscan execute IR scan <device> <instr> [dev2] [instr2] <br />
... <br />
jtag perform jtag tap actions <br />
jtag_device (DEPRECATED) jtag_device <ir_length> <ir_expected> <br />
<ir_mask> <br />
jtag_khz set maximum jtag speed (if supported); parameter <br />
is maximum khz, or 0 for adaptive clocking (RTCK). <br />
<br />
jtag_nsrst_delay jtag_nsrst_delay <ms> - delay after deasserting <br />
srst in ms <br />
jtag_ntrst_delay jtag_ntrst_delay <ms> - delay after deasserting <br />
trst in ms <br />
jtag_rclk fallback_speed_khz - set JTAG speed to RCLK or use <br />
fallback speed <br />
jtag_reset toggle reset lines <trst> <srst> <br />
jtag_speed (DEPRECATED) set jtag speed (if supported) <br />
load_image load_image <file> <address> <br />
['bin'|'ihex'|'elf'|'s19'] [min_address] <br />
[max_length] <br />
log_output redirect logging to <file> (default: stderr) <br />
mdb display memory bytes <addr> [count] <br />
mdh display memory half-words <addr> [count] <br />
mdw display memory words <addr> [count] <br />
mwb write memory byte <addr> <value> [count] <br />
mwh write memory half-word <addr> <value> [count] <br />
mww write memory word <addr> <value> [count] <br />
ocd_array2mem convert a TCL array to memory locations and write <br />
the values <ARRAYNAME> <WIDTH = 32/16/8> <br />
<ADDRESS> <COUNT> <br />
ocd_flash_banks return information about the flash banks <br />
ocd_mem2array read memory and return as a TCL array for script <br />
processing <ARRAYNAME> <WIDTH = 32/16/8> <ADDRESS> <br />
<COUNT> <br />
pathmove move JTAG to state1 then to state2, state3, etc. <br />
<state1>,<state2>,<stat3>... <br />
poll poll target state <br />
power_restore Overridable procedure run when power restore is <br />
detected. Runs 'reset init' by default. <br />
production <serialnumber> - Runs production procedure. Throws <br />
exception if procedure failed. Prints progress <br />
messages. Implement this procedure in the target <br />
script. <br />
production Runs test procedure. Throws exception if procedure <br />
failed. Prints progress messages. Implement in <br />
target script. <br />
production_info Displays information on production procedure for <br />
target script. Implement this procedure in target <br />
script. <br />
profile profiling samples the CPU PC <br />
rbp remove breakpoint <address> <br />
reg display or set a register <br />
reset reset target [run | halt | init] - default is run <br />
reset_config [none/trst_only/srst_only/trst_and_srst] <br />
[srst_pulls_trst/trst_pulls_srst] <br />
[combined/separate] <br />
[trst_push_pull/trst_open_drain] <br />
[srst_push_pull/srst_open_drain] <br />
resume resume target [addr] <br />
runtest move to Run-Test/Idle, and execute <num_cycles> <br />
rwp remove watchpoint <address> <br />
scan_chain print current scan chain configuration <br />
script <filename> - filename of OpenOCD script (tcl) to <br />
run <br />
shutdown shut the server down <br />
sleep <n> [busy] - sleep for n milliseconds. "busy" <br />
means busy wait <br />
soft_reset_halt halt the target and do a soft reset <br />
srst_deasserted Overridable procedure run when srst deassert is <br />
detected. Runs 'reset init' by default. <br />
step step one instruction from current PC or [addr] <br />
svf run svf <file> <br />
target configure target <br />
targets change the current command line target (one <br />
parameter) or lists targets (with no parameter) <br />
tcl_port port on which to listen for incoming TCL syntax <br />
telnet_port port on which to listen for incoming telnet <br />
connections <br />
test_image test_image <file> [offset] [type] <br />
tms_sequence choose short(default) or long tms_sequence <short <br />
| long> <br />
verify_image verify_image <file> [offset] [type] <br />
verify_ircapture verify value captured during Capture-IR <enable |<br />
disable><br />
verify_jtag verify value capture <enable | disable><br />
version show OpenOCD version<br />
virt2phys translate a virtual address into a physical<br />
address<br />
wait_halt wait for target halt [time (s)]<br />
wp list or set watchpoint [<address> <length> <r/w/a><br />
[value] [mask]]<br />
xsvf run xsvf <file> [virt2] [quiet]<br />
armv4_5 core_state display/change ARM core state <arm | thumb><br />
armv4_5 disassemble disassemble instructions <address> [<count><br />
['thumb']]<br />
armv4_5 reg display ARM core registers<br />
cortex_a8 cache_info display information about target caches<br />
dap apid return id reg from AP [num], default currently<br />
selected AP<br />
dap apsel select a different AP [num] (default 0)<br />
dap baseaddr return debug base address from AP [num], default<br />
currently selected AP<br />
dap info dap info for ap [num], default currently selected<br />
AP<br />
dap memaccess set/get number of extra tck for mem-ap memory bus<br />
access [0-255]<br />
flash bank flash bank <driver> <base> <size> <chip_width><br />
<bus_width> <target> [driver_options ...]<br />
mflash bank mflash bank <soc> <base> <RST pin> <target #><br />
nand device<br />
pld device<br />
target_request debugmsgs enable/disable reception of debug messages from<br />
target<br />
trace history display trace history, ['clear'] history or set<br />
[size]<br />
trace point display trace points, ['clear'] list of trace<br />
points, or add new tracepoint at [address]<br />
<br />
==Example session==<br />
<br />
Now, we can try to basically halt and resume OMAP3 (assuming U-Boot is running at U-Boot's prompt):<br />
<br />
> '''omap3_dbginit'''<br />
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
JTAG Tap/device matched<br />
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080<br />
SWJ-DP STICKY ERROR<br />
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080<br />
TargetName Type Endian TapName State<br />
-- ------------------ ---------- ------ ------------------ ------------<br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown<br />
0x54011314 00000003 ....<br />
0x54011314 00000001 ....<br />
<br />
> '''scan_chain'''<br />
TapName | Enabled | IdCode Expected IrLen IrCap IrMask Instr<br />
---|--------------------|---------|------------|------------|------|------|------|---------<br />
0 | omap3530.dsp | n | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff<br />
1 | omap3530.dap | Y | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a<br />
2 | omap3530.jrc | Y | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f<br />
<br />
> '''halt'''<br />
target state: halted<br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e87dcc<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''poll'''<br />
background polling: on<br />
TAP: omap3530.dap (enabled)<br />
target state: halted<br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e87dcc<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''resume'''<br />
<br />
> '''poll'''<br />
background polling: on<br />
TAP: omap3530.dap (enabled)<br />
target state: running<br />
<br />
> '''soft_reset_halt'''<br />
requesting target halt and executing a soft reset<br />
Target omap3.cpu does not support soft_reset_halt<br />
<br />
> '''cortex_a8 cache_info'''<br />
cache type: 0x0, unified cache<br />
D-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400<br />
I-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400<br />
<br />
> '''halt''' <br />
target state: halted <br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e88158<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''armv4_5 disassemble 0x80e88158 10'''<br />
0x80e88158 0xe3130001 TST r3, #0x1<br />
0x80e8815c 0x0afffffc BEQ 0x80e88154<br />
0x80e88160 0xe5d00000 LDRB r0, [r0]<br />
0x80e88164 0xe12fff1e BX r14<br />
0x80e88168 0xe5d00014 LDRB r0, [r0, #0x14]<br />
0x80e8816c 0xe2000001 AND r0, r0, #0x1<br />
0x80e88170 0xe12fff1e BX r14<br />
0x80e88174 0xe1a02001 MOV r2, r1<br />
0x80e88178 0xe1a01000 MOV r1, r0<br />
0x80e8817c 0xe59f0000 LDR r0, [r15]<br />
<br />
> '''step'''<br />
target state: halted<br />
target halted in ARM state due to breakpoint, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e8815c<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''step'''<br />
target state: halted<br />
target halted in ARM state due to breakpoint, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e88154<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''bp 0x80e88160 4 hw'''<br />
breakpoint set at 0x80e88160<br />
<br />
> '''resume'''<br />
<br />
''... type anything in U-Boot until breakpoint is hit ...''<br />
<br />
target state: halted<br />
target halted in ARM state due to breakpoint, current mode: Supervisor<br />
spsr_svc: 0x000001d3 pc: 0x80e88160<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''bp'''<br />
0x80e88160, 0x4, 1<br />
<br />
> '''rbp 0x80e88160'''<br />
<br />
> '''resume'''<br />
<br />
=GDB ARM=<br />
<br />
To [[DebuggingTheLinuxKernelUsingGdb|debug]] an ARM target with GNU debugger ([[GDB|GDB]]), you need a GDB understanding ARM processor. If your ARM cross compilation tool chain doesn't include a GDB, you can easily build it your self.<br />
<br />
==Build==<br />
<br />
* Download latest [http://www.gnu.org/software/gdb/download/ GDB sources]. [http://openocd.berlios.de/doc/GDB-and-OpenOCD.html#GDB-and-OpenOCD OpenOCD docu] recommends to use GDB 6.7 or newer. Here, we use GDB 6.8 which is the recent version while writing this.<br />
<br />
* Extract, configure and build GDB for ARM. Afterwards remove temporary stuff. Options are:<br />
** <path_where_ARM_gdb_shall_be_installed_to> : Directory where you want to install the resulting tool to. E.g. /home/user/arm-gdb/<br />
** <ARM_toolchain_prefix> : The prefix of your ARM GCC toolchain, e.g. ''arm-linux'' or ''arm-none-linux-gnueabi'' ([[BeagleBoard#Cortex_A8_ARM|CodeSourcery tool chain]]).<br />
<br />
> tar xfj gdb-6.8.tar.bz2<br />
> mkdir build-gdb<br />
> cd build-gdb/<br />
build-gdb > ../gdb-6.8/configure --prefix=<path_where_ARM_gdb_shall_be_installed_to> --target=<ARM_toolchain_prefix> i686-pc-linux-gnu<br />
build-gdb > make -j4<br />
build-gdb > make install<br />
build-gdb > cd ..<br />
> rm -rf gdb-6.8 build-gdb<br />
> export PATH=$PATH:<path_where_ARM_gdb_shall_be_installed_to>/bin<br />
<br />
Test:<br />
<br />
bin> ./arm-none-linux-gnueabi-gdb<br />
GNU gdb 6.8<br />
Copyright (C) 2008 Free Software Foundation, Inc.<br />
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br />
This is free software: you are free to change and redistribute it.<br />
There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br />
and "show warranty" for details.<br />
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".<br />
(gdb)<br />
<br />
==Example session==<br />
<br />
To use gdb, you have to connect to running OpenOCD using remote command. E.g.:<br />
<br />
> '''arm-none-linux-gnueabi-gdb'''<br />
GNU gdb 6.8<br />
Copyright (C) 2008 Free Software Foundation, Inc.<br />
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br />
This is free software: you are free to change and redistribute it.<br />
There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br />
and "show warranty" for details.<br />
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".<br />
<br />
(gdb) '''target remote localhost:3333'''<br />
Remote debugging using localhost:3333<br />
0x00000000 in ?? () <br />
(gdb) '''monitor omap3_dbginit''' <br />
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080 <br />
SWJ-DP STICKY ERROR <br />
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080 <br />
TargetName Type Endian TapName State <br />
-- ------------------ ---------- ------ ------------------ ------------ <br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown <br />
0x54011314 00000003 .... <br />
0x54011314 00000001 .... <br />
<br />
(gdb) '''monitor scan_chain''' <br />
TapName | Enabled | IdCode Expected IrLen IrCap IrMask Instr <br />
---|--------------------|---------|------------|------------|------|------|------|--------- <br />
0 | omap3530.dsp | n | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff<br />
1 | omap3530.dap | Y | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a <br />
2 | omap3530.jrc | Y | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f<br />
<br />
(gdb) '''info registers'''<br />
r0 0x0 0<br />
r1 0x60a 1546<br />
r2 0x80000100 2147483904<br />
r3 0x706 1798 <br />
r4 0xc00081b8 3221258680<br />
r5 0x0 0 <br />
r6 0x80026960 2147641696<br />
r7 0xc00081b8 3221258680<br />
r8 0x0 0 <br />
r9 0x411fc082 1092599938<br />
r10 0x800268f8 2147641592<br />
r11 0xf731c8f9 4147235065<br />
r12 0x80796ae0 2155440864<br />
sp 0x8051a900 0x8051a900<br />
lr 0x80008018 2147516440<br />
pc 0x8000815c 0x8000815c<br />
fps 0x0 0 <br />
cpsr 0x0 0 <br />
<br />
(gdb) '''p/x $pc''' <br />
$2 = 0x8000815c <br />
<br />
(gdb) '''x/i $pc''' <br />
0x8000815c: nop (mov r0,r0)<br />
<br />
(gdb) '''x'''<br />
0x80008160: b 0x8000815c<br />
<br />
==LED blink example==<br />
<br />
Magnus Lundin has a simple standalone LED blink test program which can be used for tests.<br />
<br />
* [http://github.com/mlu/cortal_dendrites/tree/6ed04b7e838981f594eb6b701a17c220fff952dd/cortex_a8/standalone/LEDblink LED blink] test program.<br />
* [http://github.com/mlu/cortal_dendrites/blob/6ed04b7e838981f594eb6b701a17c220fff952dd/cortex_a8/standalone/LEDblink/README README]<br />
* Example .gdbinit file:<br />
<br />
echo *** Executing .gdbint to set up the environment for debugging gdb:\n<br />
<br />
# This connects to OpenOcd at localhost:3333<br />
target remote localhost:3333<br />
<br />
# omap3_dbginit must be run in OpenOCD after every reset<br />
monitor omap3_dbginit<br />
<br />
# Stop core<br />
monitor halt<br />
<br />
echo *** Environment ready, now load and start executeable:\n<br />
<br />
# Load the program executable called "LEDblink"<br />
load LEDblink<br />
<br />
# Load the symbols for the program.<br />
symbol-file LEDblink<br />
<br />
# Set a breakpoint at main().<br />
b main<br />
<br />
# Run to the breakpoint.<br />
cont<br />
<br />
Clone the code by git, goto ''cortex_a8/standalone/LEDblink'' directory, build the example using provided Makefile and then in that directory start gdb (so that above .gdbinit is executed):<br />
<br />
> '''arm-none-linux-gnueabi-gdb'''<br />
GNU gdb 6.8<br />
Copyright (C) 2008 Free Software Foundation, Inc.<br />
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br />
This is free software: you are free to change and redistribute it.<br />
There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br />
and "show warranty" for details.<br />
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".<br />
*** Executing .gdbint to set up the environment for debugging gdb:<br />
0x00000000 in ?? ()<br />
The target may not be able to correctly handle a memory-write-packet-size<br />
of 1024 bytes. Change the packet size? (y or n) [answered Y; input not from terminal]<br />
TargetName Type Endian TapName State<br />
-- ------------------ ---------- ------ ------------------ ------------<br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown<br />
target state: halted<br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x600001d3 pc: 0x80008160<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
*** Environment ready, now load and start executeable:<br />
Loading section .text, size 0xe0 lma 0x82000000<br />
Start address 0x82000000, load size 224<br />
Transfer rate: 4 KB/sec, 224 bytes/write.<br />
Current language: auto; currently asm<br />
Breakpoint 1 at 0x8200003c: file LEDblink.c, line 22.<br />
<br />
Breakpoint 1, main () at LEDblink.c:22<br />
22 LEDbrightness++;<br />
Current language: auto; currently c<br />
<br />
(gdb) '''cont'''<br />
<br />
This should let Beagle's LEDs blink.<br />
<br />
=Development internals=<br />
<br />
The sections below give some datails if you are interested in developing OpenOCD for OMAP3 and Cortex A8 used on Beagle. If you like to help to improve OpenOCD support for Beagle, this might help you.<br />
<br />
==Introduction==<br />
<br />
Magnus Lundin wrote a very nice [http://arttools.blogspot.com/2009/09/debugging-on-cortex-a8-system.html introduction] on the basic Cortex A8 (OMAP3) debug architecture.<br />
<br />
==Cortex A8 support==<br />
<br />
As mentioned above, OpenOCD has initial experimental Cortex A8 support. Rick Altherr wrote (thanks!) a [https://lists.berlios.de/pipermail/openocd-development/2009-April/005273.html nice intro] how to help with Cortex A8 support for OpenOCD:<br />
<br />
''The [http://svn.berlios.de/svnroot/repos/openocd/trunk/src/target/cortex_m3.c Cortex-M3 support] is very similar to Cortex-A8 up to a certain layer. The ARM debug interface is designed as a set of layers that build on each other and can do automatic discovery. The [http://svn.berlios.de/svnroot/repos/openocd/trunk/src/target/cortex_swjdp.c cortex-swjdp] support in OpenOCD is a good start, but it assumes which AHB and APB ports are available. The first item would be to verify the cortex-swjdp portion against the documents for the CoreSight debug interface.''<br />
<br />
''To really get started, familiarize yourself with the following docs:''<br />
* ''[http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ihi0031a/index.html ARM IHI 0031A] (ARM Debug Interface v5)'' - only available to registered ARM customers<br />
* ''[http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ihi0029b/index.html ARM IHI 0029B] (CoreSight v1.0)'' - only available to registered ARM customers<br />
* ''[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0316d/DDI0316D_dap_lite_trm.pdf ARM DDI 0316D] (CoreSight DAP-Lite)''<br />
* ''[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0314f/DDI0314F_coresight_component_trm.pdf ARM DDI 0314F] (CoreSight Components TRM)''<br />
* ''[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf ARM DDI 0344H] (Cortex-A8 TRM, primarily chapter 12)''<br />
<br />
''These should be listed in the right order for getting up to speed. Basically the Cortex-A8 debug registers are accessed externally via CoreSight. CoreSight is an implementation of the ARM Debug Interface v5.''<br />
<br />
''The cortex-swjdp implementation in OpenOCD deals with CoreSight but makes some assumptions about which CoreSight components are available. For Cortex-A8, that will likely need to change a bit as the set of components will be different.''<br />
<br />
''After cortex-swjdp is patched to handle the new components, a cortex-a8 target implementation can be started by using the cortex-swjdp layer to access the various debug registers and memory locations.''<br />
<br />
For discussion about this, see [https://lists.berlios.de/pipermail/openocd-development/2009-March/005097.html mail #1], [https://lists.berlios.de/pipermail/openocd-development/2009-March/005099.html mail #2] and [https://lists.berlios.de/pipermail/openocd-development/2009-March/005117.html mail #3].<br />
<br />
Note: With revision ~1570 the cortex-swjdp module in OpenOCD has been renamed to arm_adi_v5 and updated to remove all dependencies on Cortex-M3 specific features and as far as possible only use the ARM Debug Interface v5 features. The Cortex-M3 specifics has been moved to cortex_m3 module. This is a step in preparing OpenOCD for full Cortex-A8 support. <br />
<br />
Using recent OpenOCD versions, you can examine CoreSight APs: <br />
<br />
<pre><br />
> version <br />
Open On-Chip Debugger 0.3.0-in-development (2009-08-30-19:54) svn:2643M<br />
<br />
> omap3_dbginit<br />
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
JTAG Tap/device matched<br />
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080<br />
SWJ-DP STICKY ERROR<br />
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080<br />
TargetName Type Endian TapName State<br />
-- ------------------ ---------- ------ ------------------ ------------<br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown<br />
0x54011314 00000003 ....<br />
0x54011314 00000001 ....<br />
<br />
> scan_chain<br />
TapName | Enabled | IdCode Expected IrLen IrCap IrMask Instr<br />
---|--------------------|---------|------------|------------|------|------|------|---------<br />
0 | omap3530.dsp | n | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff<br />
1 | omap3530.dap | Y | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a<br />
2 | omap3530.jrc | Y | 0x00000000 | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f<br />
<br />
> dap apsel 0<br />
ap 0 selected, identification register 0x14770001<br />
<br />
> dap info 0<br />
ap identification register 0x14770001<br />
Type is mem-ap AHB <br />
ap debugbase 0xffffffff <br />
No ROM table present <br />
<br />
> dap info 1<br />
ap identification register 0x04770002<br />
Type is mem-ap APB <br />
ap debugbase 0x80000000 <br />
ROM table in legacy format<br />
CID3 0xb1, CID2 0x5, CID1 0x10, CID0, 0xd<br />
MEMTYPE system memory not present. Dedicated debug bus<br />
ROMTABLE[0x0] = 0xd4010003 <br />
Component base address 0x54010000, pid4 0x4, start address 0x54010000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21 <br />
ROMTABLE[0x4] = 0xd4011003 <br />
Component base address 0x54011000, pid4 0x4, start address 0x54011000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8 <br />
ROMTABLE[0x8] = 0xd4012003 <br />
Component base address 0x54012000, pid4 0x0, start address 0x54012000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13 <br />
ROMTABLE[0xc] = 0xd4013002 <br />
Component not present <br />
ROMTABLE[0x10] = 0xd4019003 <br />
Component base address 0x54019000, pid4 0x4, start address 0x54019000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12 <br />
ROMTABLE[0x14] = 0xd401b003 <br />
Component base address 0x5401b000, pid4 0x4, start address 0x5401b000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7 <br />
ROMTABLE[0x18] = 0xd401d003 <br />
Component base address 0x5401d000, pid4 0x0, start address 0x5401d000<br />
Component cid1 0xf0, class is Non standard layout<br />
CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd<br />
PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43<br />
ROMTABLE[0x1c] = 0xd4500003<br />
Component base address 0x54500000, pid4 0x0, start address 0x54500000<br />
Component cid1 0x90, class is CoreSight component<br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd<br />
PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20<br />
ROMTABLE[0x20] = 0x0<br />
End of ROM table<br />
<br />
> dap apsel 1<br />
ap 1 selected, identification register 0x04770002<br />
<br />
> dap apsel 2<br />
ap 2 selected, identification register 0x14760010<br />
<br />
> dap info 2<br />
ap identification register 0x14760010<br />
Type is jtag-ap<br />
ap debugbase 0x00000000<br />
No ROM table present<br />
<br />
> dap apsel 3<br />
ap 3 selected, identification register 0x00000000<br />
<br />
> dap info 3<br />
ap identification register 0x00000000<br />
No AP found at this apsel 0x3<br />
No ROM table present<br />
<br />
><br />
</pre><br />
<br />
==ROMTable==<br />
<br />
To interpret content of above ROMTable, have a look to<br />
<br />
* [http://www.ti.com/litv/pdf/spruf98b OMAP35x Technical Reference Manual (Rev. B)] (spruf98b.pdf, 39622 Kbytes), Table 5-105<br />
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0314f/DDI0314F_coresight_component_trm.pdf CoreSight Components TRM] (ARM DDI 0314F), Table 2-3<br />
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM] (ARM DDI 0344H)<br />
<br />
With this, we get (first three entries are in the MPU SS Module, address range 0x54010000 - 0x54018000, part number is given by PID1[3-0] and PID0[7-0]):<br />
<br />
ROMTABLE[0x0] = 0xd4010003 <br />
Component base address 0x54010000, pid4 0x4, start address 0x54010000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21<br />
<br />
* Part number is 0x921: ETM module. See [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM] chapter 14.<br />
<br />
ROMTABLE[0x4] = 0xd4011003 <br />
Component base address 0x54011000, pid4 0x4, start address 0x54011000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8 <br />
<br />
* Part number is 0xC08: This is the [[BeagleBoardOpenOCD#Debug_Register_Interface|Debug Register Interface]]. See table 12-3 in the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM].<br />
<br />
ROMTABLE[0x8] = 0xd4012003 <br />
Component base address 0x54012000, pid4 0x0, start address 0x54012000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13 <br />
<br />
* Part number 0x113: This is ????<br />
<br />
ROMTABLE[0x10] = 0xd4019003 <br />
Component base address 0x54019000, pid4 0x4, start address 0x54019000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12 <br />
<br />
* Part number 0x912: TPIU Module. <br />
<br />
ROMTABLE[0x14] = 0xd401b003 <br />
Component base address 0x5401b000, pid4 0x4, start address 0x5401b000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7 <br />
<br />
* Part number 0x907: ETB Module.<br />
<br />
ROMTABLE[0x18] = 0xd401d003 <br />
Component base address 0x5401d000, pid4 0x0, start address 0x5401d000<br />
Component cid1 0xf0, class is Non standard layout<br />
CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd<br />
PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43<br />
<br />
* Part number 0x343: DAP CTL Module.<br />
<br />
ROMTABLE[0x1c] = 0xd4500003<br />
Component base address 0x54500000, pid4 0x0, start address 0x54500000<br />
Component cid1 0x90, class is CoreSight component<br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd<br />
PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20<br />
<br />
* Part number 0x120: SDTI Module.<br />
<br />
==Debug Register Interface==<br />
<br />
With above info about debug register interface and table 12-3 in the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM] we are able to access this interface using OpenOCDs ''mdw'' command:<br />
<br />
> omap3.cpu mdw 0x54011000<br />
0x54011000 15141012<br />
<br />
This is the debug ID register. See table 12-11 of [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM]:<br />
<br />
{|border=1<br />
!Bits<br />
!Field<br />
!Value & Function<br />
|-<br />
|[31-28]<br />
|WRP<br />
|0x1 -> 2 WRPs are implemented<br />
|-<br />
|[27-24]<br />
|BRP<br />
|0x5 -> 6 BRPs are implemented<br />
|-<br />
|[23-20]<br />
|Context<br />
|0x1 -> 2 BRPs have context ID capability<br />
|-<br />
|[19-16]<br />
|Debug architecture version<br />
|0x4 -> ARMv7 debug<br />
|-<br />
|[12]<br />
|security<br />
|0x1 -> Security extensions implemented<br />
|-<br />
|[7-4]<br />
|variant<br />
|0x1<br />
|-<br />
|[3-0]<br />
|revision<br />
|0x2 <br />
|-<br />
|}<br />
<br />
> omap3.cpu mdw 0x54011FF0<br />
0x54011ff0 0000000d<br />
> omap3.cpu mdw 0x54011FF4<br />
0x54011ff4 00000090<br />
> omap3.cpu mdw 0x54011FF8<br />
0x54011ff8 00000005<br />
> omap3.cpu mdw 0x54011FFC<br />
0x54011ffc 000000b1<br />
<br />
These are the component identification registers. See table 12-51 of [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM].</div>Ichirohttps://elinux.org/index.php?title=BeagleBoardOpenOCD&diff=14338BeagleBoardOpenOCD2009-10-22T14:34:11Z<p>Ichiro: /* Build OpenOCD */</p>
<hr />
<div>[[Category: Linux]]<br />
[[Category: OMAP]]<br />
[[Category:Development Boards]]<br />
[[Category: BeagleBoard]]<br />
This page is about how to use open source [http://openocd.berlios.de/web/ OpenOCD] [http://en.wikipedia.org/wiki/JTAG JTAG] software with [[BeagleBoard|BeagleBoard]]. With this, it will be possible to have OMAP3 JTAG debug using cheap [[BeagleBoardJTAG|JTAG hardware]], e.g. [[BeagleBoardJTAG#TinCanTools_Flyswatter|Flyswatter]].<br />
<br />
'''As of September 2009, OpenOCD has basic support for OMAP3 and [[BeagleBoardOpenOCD#Cortex_A8_support|ARM Cortex A8]] on Beagle Board. Cortex A8 support is in early alpha stage, a lot is still missing. But e.g. processor halt, resume, step, breakpoints and ARM disassembly of non-Cache and non-MMU (e.g. U-Boot) applications seem to work.<br />
<br />
Status:<br />
<br />
* You need at least OpenOCD revision '''2770''' ([[BeagleBoardOpenOCD#Build_OpenOCD|using svn]]). With this revision you will have basic access to OMAP3 and Cortex A8 can be basically controlled. This does mean, that OpenOCD is able to configure scan chain correctly to [[OMAP3530_ICEPICK#ICEPICK_infos|access ARM TAP]] ("JTAG controller"), explore CoreSight AccessPoints and halt, resume, step, breakpoints and ARM disassembly on Cortex A8.<br />
* Recent status as of '''September 2009''':<br />
** OpenOCD >= 2770 can and halt, resume, step, breakpoints and ARM disassembly Cortex A8 (ARM) processor on Beagle.<br />
** This works for non-MMU and non-Cache applications (e.g U-Boot).<br />
** [https://lists.berlios.de/pipermail/openocd-development/2009-August/010184.html Linux debugging doesn't work yet].<br />
<br />
<br />
=Hardware=<br />
<br />
To be able to use OpenOCD with OMAP3 based BeagleBoard, make sure that your JTAG Dongle supports:<br />
<br />
* 1.8V devices. Many JTAG dongles are 3.3V only! '''Verify that your dongle supports 1.8V!''' Else the dongle will overpowering the input to OMAP3 and may cause damage.<br />
* Your JTAG dongle is able to switch [[BeagleBoardJTAG#Beagle_JTAG_connection|EMU0 & EMU1 pins high]].<br />
<br />
Flyswatter dongle supports both requirements. If you use [http://tincantools.com/product.php?productid=16144 BeagleBoard Adapter Kit] with [[BeagleBoardJTAG#TinCanTools_Flyswatter|Flyswatter]], make sure you plug the JTAG adapter the correct way. There are several possible ways, though. See [http://www.tincantools.com/images/D/Fly%2BBeagle-800x391.JPG?1229714946602 connection picture] how to do it the right way. In contrast to the picture EMU0 & EMU1 jumpers at JTAG adapter should be both at 1-2 position (touching J2).<br />
<br />
=Build OpenOCD=<br />
<br />
[http://openfacts.berlios.de/index-en.phtml?title=Building_OpenOCD OpenOCD build instructions] describe how to build [http://openocd.berlios.de/web/ OpenOCD]. For questions you can use [https://lists.berlios.de/mailman/listinfo/openocd-development OpenOCD Mailing list].<br />
<br />
Get OpenOCD code git:<br />
<br />
> git clone git://openocd.git.sourceforge.net/gitroot/openocd/openocd<br />
<br />
For Flyswatter you additionally need [http://www.ftdichip.com/Drivers/D2XX.htm libftd2xx] or [http://www.intra2net.com/de/produkte/opensource/ftdi/ libFTDI]. While libFTDI is available in source, libftd2xx is supposed to be 50% [http://www.beagleboard.org/irclogs/index.php?date=2008-10-16#T16:06:22 faster] than libFTDI. The libtfd2xx binaries are available booth as shared library or linkable archive.<br />
<br />
If you downloaded OpenOCD svn and have libftd2xx or libFTDI, build OpenOCD (assuming you extracted/built FTDI library already):<br />
<br />
> cd openocd<br />
> ./bootstrap<br />
> ./configure --enable-ft2232_ftd2xx --with-ftd2xx-linux-tardir=<path_to>/libftd2xx0.4.16 --prefix=/home/user/bin/openOCD<br />
''or'' (depending which FTDI library you use, see above)<br />
> ./configure --enable-ft2232_libftdi --prefix=/home/user/bin/openOCD<br />
> make<br />
> make install<br />
<br />
'''Note''': By default (make & make install) only .info documentation is installed. You can get PDF or HTML documentation by<br />
<br />
make pdf<br />
<br />
or<br />
<br />
make html<br />
<br />
Resulting documentation can be found in openocd/doc, then.<br />
<br />
'''Note''': If you like to save some disk space and don't plan to debug OpenOCD binary itself, you can strip this (remove unneeded debug symbols):<br />
<br />
> cd <openocd_install_dir>/bin<br />
> strip openocd<br />
<br />
(e.g. with OpenOCD 1.0 this reduced binary size from ~3MB to ~700kB)<br />
<br />
'''Note''': If you don't have libftdi in standard path, you might like to extend library search path:<br />
<br />
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<path_to>/lib<br />
<br />
if you e.g. get<br />
<br />
> ./openocd<br />
./openocd: error while loading shared libraries: libftdi.so.1: cannot open shared object file: No such file or directory<br />
<br />
=Starting OpenOCD=<br />
<br />
OpenOCD runtime is controlled by several [http://openocd.berlios.de/doc/html/index.html#toc_Config-File-Guidelines configuration files]. OpenOCD comes with basic configuration files for BeagleBoard (''board/ti_beagleboard.cfg'') and OMAP3 (''target/omap3530.cfg'').<br />
<br />
Assuming that you use Flyswatter and it is switched on (attached to USB), you can now start OpenOCD with:<br />
<br />
openocd -s <path_to_config_files> // e.g. <path_of_openocd_install_dir>/lib/openocd<br />
-f <path_to_jtag_interface><br />
-f <path_to_beagle_config><br />
<br />
This should result in<br />
<br />
> '''openocd -s lib/openocd/ -f interface/flyswatter.cfg -f board/ti_beagleboard.cfg'''<br />
Open On-Chip Debugger 0.3.0-in-development (2009-09-29-16:28) svn:2770<br />
$URL: svn://svn.berlios.de/openocd/trunk/src/openocd.c $<br />
For bug reports, read http://svn.berlios.de/svnroot/repos/openocd/trunk/BUGS<br />
RCLK - adaptive <br />
Warn : huge IR length 38 <br />
Info : RCLK (adaptive clock speed) not supported - fallback to 6000 kHz<br />
Info : JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
<br />
This shows that your (Flyswatter) JTAG dongle basically works and that you are able to see OMAP3 JRC. OpenOCD now runs as deamon.<br />
<br />
=Controlling OpenOCD=<br />
<br />
Once OpenOCD runs as [http://openocd.berlios.de/doc/html/Running.html#Running daemon] like above, you can connect using ''telnet'' or ''GDB''<br />
<br />
==telnet==<br />
<br />
Connect to OpenOCD daemon. Assuming you do it on your local machine, open a second terminal window and do (assuming port 4444 as configured in above openocd.cfg):<br />
<br />
> '''telnet localhost 4444'''<br />
Trying 127.0.0.1...<br />
Connected to localhost.<br />
Escape character is '^]'.<br />
Open On-Chip Debugger<br />
> <br />
<br />
This should give you<br />
<br />
Info: accepting 'telnet' connection from 0<br />
<br />
in window where OpenOCD daemon is started.<br />
<br />
At OpenOCDs telnet prompt you can now issue OpenOCD commands. E.g. ''help'' should result in<br />
<br />
> '''help''' <br />
bp list or set breakpoint [<address> <length> [hw]]<br />
cpu <name> - prints out target options and a comment <br />
on CPU which matches name <br />
debug_level adjust debug level <0-3> <br />
drscan execute DR scan <device> <num_bits> <value> <br />
<num_bits1> <value2> ... <br />
dump_image dump_image <file> <address> <size> <br />
exit exit telnet session <br />
fast fast <enable/disable> - place at beginning of <br />
config files. Sets defaults to fast and dangerous.<br />
<br />
fast_load loads active fast load image to current target - <br />
mainly for profiling purposes <br />
fast_load_image same args as load_image, image stored in memory - <br />
mainly for profiling purposes <br />
find <file> - print full path to file according to <br />
OpenOCD search rules <br />
flush_count returns number of times the JTAG queue has been <br />
flushed <br />
ft2232_device_desc the USB device description of the FTDI FT2232 <br />
device <br />
ft2232_latency set the FT2232 latency timer to a new value <br />
ft2232_layout the layout of the FT2232 GPIO signals used to <br />
control output-enables and reset signals <br />
ft2232_serial the serial number of the FTDI FT2232 device <br />
ft2232_vid_pid the vendor ID and product ID of the FTDI FT2232 <br />
device <br />
gdb_breakpoint_override hard/soft/disable - force breakpoint type for gdb <br />
'break' commands. <br />
gdb_detach resume/reset/halt/nothing - specify behavior when <br />
GDB detaches from the target <br />
gdb_flash_program enable or disable flash program <br />
gdb_memory_map enable or disable memory map <br />
gdb_port daemon configuration command gdb_port <br />
gdb_report_data_abort enable or disable reporting data aborts <br />
halt halt target <br />
help Tcl implementation of help command <br />
init initializes target and servers - nop on subsequent <br />
invocations <br />
interface try to configure interface <br />
interface_list list all built-in interfaces <br />
irscan execute IR scan <device> <instr> [dev2] [instr2] <br />
... <br />
jtag perform jtag tap actions <br />
jtag_device (DEPRECATED) jtag_device <ir_length> <ir_expected> <br />
<ir_mask> <br />
jtag_khz set maximum jtag speed (if supported); parameter <br />
is maximum khz, or 0 for adaptive clocking (RTCK). <br />
<br />
jtag_nsrst_delay jtag_nsrst_delay <ms> - delay after deasserting <br />
srst in ms <br />
jtag_ntrst_delay jtag_ntrst_delay <ms> - delay after deasserting <br />
trst in ms <br />
jtag_rclk fallback_speed_khz - set JTAG speed to RCLK or use <br />
fallback speed <br />
jtag_reset toggle reset lines <trst> <srst> <br />
jtag_speed (DEPRECATED) set jtag speed (if supported) <br />
load_image load_image <file> <address> <br />
['bin'|'ihex'|'elf'|'s19'] [min_address] <br />
[max_length] <br />
log_output redirect logging to <file> (default: stderr) <br />
mdb display memory bytes <addr> [count] <br />
mdh display memory half-words <addr> [count] <br />
mdw display memory words <addr> [count] <br />
mwb write memory byte <addr> <value> [count] <br />
mwh write memory half-word <addr> <value> [count] <br />
mww write memory word <addr> <value> [count] <br />
ocd_array2mem convert a TCL array to memory locations and write <br />
the values <ARRAYNAME> <WIDTH = 32/16/8> <br />
<ADDRESS> <COUNT> <br />
ocd_flash_banks return information about the flash banks <br />
ocd_mem2array read memory and return as a TCL array for script <br />
processing <ARRAYNAME> <WIDTH = 32/16/8> <ADDRESS> <br />
<COUNT> <br />
pathmove move JTAG to state1 then to state2, state3, etc. <br />
<state1>,<state2>,<stat3>... <br />
poll poll target state <br />
power_restore Overridable procedure run when power restore is <br />
detected. Runs 'reset init' by default. <br />
production <serialnumber> - Runs production procedure. Throws <br />
exception if procedure failed. Prints progress <br />
messages. Implement this procedure in the target <br />
script. <br />
production Runs test procedure. Throws exception if procedure <br />
failed. Prints progress messages. Implement in <br />
target script. <br />
production_info Displays information on production procedure for <br />
target script. Implement this procedure in target <br />
script. <br />
profile profiling samples the CPU PC <br />
rbp remove breakpoint <address> <br />
reg display or set a register <br />
reset reset target [run | halt | init] - default is run <br />
reset_config [none/trst_only/srst_only/trst_and_srst] <br />
[srst_pulls_trst/trst_pulls_srst] <br />
[combined/separate] <br />
[trst_push_pull/trst_open_drain] <br />
[srst_push_pull/srst_open_drain] <br />
resume resume target [addr] <br />
runtest move to Run-Test/Idle, and execute <num_cycles> <br />
rwp remove watchpoint <address> <br />
scan_chain print current scan chain configuration <br />
script <filename> - filename of OpenOCD script (tcl) to <br />
run <br />
shutdown shut the server down <br />
sleep <n> [busy] - sleep for n milliseconds. "busy" <br />
means busy wait <br />
soft_reset_halt halt the target and do a soft reset <br />
srst_deasserted Overridable procedure run when srst deassert is <br />
detected. Runs 'reset init' by default. <br />
step step one instruction from current PC or [addr] <br />
svf run svf <file> <br />
target configure target <br />
targets change the current command line target (one <br />
parameter) or lists targets (with no parameter) <br />
tcl_port port on which to listen for incoming TCL syntax <br />
telnet_port port on which to listen for incoming telnet <br />
connections <br />
test_image test_image <file> [offset] [type] <br />
tms_sequence choose short(default) or long tms_sequence <short <br />
| long> <br />
verify_image verify_image <file> [offset] [type] <br />
verify_ircapture verify value captured during Capture-IR <enable |<br />
disable><br />
verify_jtag verify value capture <enable | disable><br />
version show OpenOCD version<br />
virt2phys translate a virtual address into a physical<br />
address<br />
wait_halt wait for target halt [time (s)]<br />
wp list or set watchpoint [<address> <length> <r/w/a><br />
[value] [mask]]<br />
xsvf run xsvf <file> [virt2] [quiet]<br />
armv4_5 core_state display/change ARM core state <arm | thumb><br />
armv4_5 disassemble disassemble instructions <address> [<count><br />
['thumb']]<br />
armv4_5 reg display ARM core registers<br />
cortex_a8 cache_info display information about target caches<br />
dap apid return id reg from AP [num], default currently<br />
selected AP<br />
dap apsel select a different AP [num] (default 0)<br />
dap baseaddr return debug base address from AP [num], default<br />
currently selected AP<br />
dap info dap info for ap [num], default currently selected<br />
AP<br />
dap memaccess set/get number of extra tck for mem-ap memory bus<br />
access [0-255]<br />
flash bank flash bank <driver> <base> <size> <chip_width><br />
<bus_width> <target> [driver_options ...]<br />
mflash bank mflash bank <soc> <base> <RST pin> <target #><br />
nand device<br />
pld device<br />
target_request debugmsgs enable/disable reception of debug messages from<br />
target<br />
trace history display trace history, ['clear'] history or set<br />
[size]<br />
trace point display trace points, ['clear'] list of trace<br />
points, or add new tracepoint at [address]<br />
<br />
==Example session==<br />
<br />
Now, we can try to basically halt and resume OMAP3 (assuming U-Boot is running at U-Boot's prompt):<br />
<br />
> '''omap3_dbginit'''<br />
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
JTAG Tap/device matched<br />
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080<br />
SWJ-DP STICKY ERROR<br />
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080<br />
TargetName Type Endian TapName State<br />
-- ------------------ ---------- ------ ------------------ ------------<br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown<br />
0x54011314 00000003 ....<br />
0x54011314 00000001 ....<br />
<br />
> '''scan_chain'''<br />
TapName | Enabled | IdCode Expected IrLen IrCap IrMask Instr<br />
---|--------------------|---------|------------|------------|------|------|------|---------<br />
0 | omap3530.dsp | n | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff<br />
1 | omap3530.dap | Y | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a<br />
2 | omap3530.jrc | Y | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f<br />
<br />
> '''halt'''<br />
target state: halted<br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e87dcc<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''poll'''<br />
background polling: on<br />
TAP: omap3530.dap (enabled)<br />
target state: halted<br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e87dcc<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''resume'''<br />
<br />
> '''poll'''<br />
background polling: on<br />
TAP: omap3530.dap (enabled)<br />
target state: running<br />
<br />
> '''soft_reset_halt'''<br />
requesting target halt and executing a soft reset<br />
Target omap3.cpu does not support soft_reset_halt<br />
<br />
> '''cortex_a8 cache_info'''<br />
cache type: 0x0, unified cache<br />
D-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400<br />
I-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400<br />
<br />
> '''halt''' <br />
target state: halted <br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e88158<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''armv4_5 disassemble 0x80e88158 10'''<br />
0x80e88158 0xe3130001 TST r3, #0x1<br />
0x80e8815c 0x0afffffc BEQ 0x80e88154<br />
0x80e88160 0xe5d00000 LDRB r0, [r0]<br />
0x80e88164 0xe12fff1e BX r14<br />
0x80e88168 0xe5d00014 LDRB r0, [r0, #0x14]<br />
0x80e8816c 0xe2000001 AND r0, r0, #0x1<br />
0x80e88170 0xe12fff1e BX r14<br />
0x80e88174 0xe1a02001 MOV r2, r1<br />
0x80e88178 0xe1a01000 MOV r1, r0<br />
0x80e8817c 0xe59f0000 LDR r0, [r15]<br />
<br />
> '''step'''<br />
target state: halted<br />
target halted in ARM state due to breakpoint, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e8815c<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''step'''<br />
target state: halted<br />
target halted in ARM state due to breakpoint, current mode: Supervisor<br />
spsr_svc: 0x400001d3 pc: 0x80e88154<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''bp 0x80e88160 4 hw'''<br />
breakpoint set at 0x80e88160<br />
<br />
> '''resume'''<br />
<br />
''... type anything in U-Boot until breakpoint is hit ...''<br />
<br />
target state: halted<br />
target halted in ARM state due to breakpoint, current mode: Supervisor<br />
spsr_svc: 0x000001d3 pc: 0x80e88160<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
<br />
> '''bp'''<br />
0x80e88160, 0x4, 1<br />
<br />
> '''rbp 0x80e88160'''<br />
<br />
> '''resume'''<br />
<br />
=GDB ARM=<br />
<br />
To [[DebuggingTheLinuxKernelUsingGdb|debug]] an ARM target with GNU debugger ([[GDB|GDB]]), you need a GDB understanding ARM processor. If your ARM cross compilation tool chain doesn't include a GDB, you can easily build it your self.<br />
<br />
==Build==<br />
<br />
* Download latest [http://www.gnu.org/software/gdb/download/ GDB sources]. [http://openocd.berlios.de/doc/GDB-and-OpenOCD.html#GDB-and-OpenOCD OpenOCD docu] recommends to use GDB 6.7 or newer. Here, we use GDB 6.8 which is the recent version while writing this.<br />
<br />
* Extract, configure and build GDB for ARM. Afterwards remove temporary stuff. Options are:<br />
** <path_where_ARM_gdb_shall_be_installed_to> : Directory where you want to install the resulting tool to. E.g. /home/user/arm-gdb/<br />
** <ARM_toolchain_prefix> : The prefix of your ARM GCC toolchain, e.g. ''arm-linux'' or ''arm-none-linux-gnueabi'' ([[BeagleBoard#Cortex_A8_ARM|CodeSourcery tool chain]]).<br />
<br />
> tar xfj gdb-6.8.tar.bz2<br />
> mkdir build-gdb<br />
> cd build-gdb/<br />
build-gdb > ../gdb-6.8/configure --prefix=<path_where_ARM_gdb_shall_be_installed_to> --target=<ARM_toolchain_prefix> i686-pc-linux-gnu<br />
build-gdb > make -j4<br />
build-gdb > make install<br />
build-gdb > cd ..<br />
> rm -rf gdb-6.8 build-gdb<br />
> export PATH=$PATH:<path_where_ARM_gdb_shall_be_installed_to>/bin<br />
<br />
Test:<br />
<br />
bin> ./arm-none-linux-gnueabi-gdb<br />
GNU gdb 6.8<br />
Copyright (C) 2008 Free Software Foundation, Inc.<br />
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br />
This is free software: you are free to change and redistribute it.<br />
There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br />
and "show warranty" for details.<br />
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".<br />
(gdb)<br />
<br />
==Example session==<br />
<br />
To use gdb, you have to connect to running OpenOCD using remote command. E.g.:<br />
<br />
> '''arm-none-linux-gnueabi-gdb'''<br />
GNU gdb 6.8<br />
Copyright (C) 2008 Free Software Foundation, Inc.<br />
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br />
This is free software: you are free to change and redistribute it.<br />
There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br />
and "show warranty" for details.<br />
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".<br />
<br />
(gdb) '''target remote localhost:3333'''<br />
Remote debugging using localhost:3333<br />
0x00000000 in ?? () <br />
(gdb) '''monitor omap3_dbginit''' <br />
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080 <br />
SWJ-DP STICKY ERROR <br />
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080 <br />
TargetName Type Endian TapName State <br />
-- ------------------ ---------- ------ ------------------ ------------ <br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown <br />
0x54011314 00000003 .... <br />
0x54011314 00000001 .... <br />
<br />
(gdb) '''monitor scan_chain''' <br />
TapName | Enabled | IdCode Expected IrLen IrCap IrMask Instr <br />
---|--------------------|---------|------------|------------|------|------|------|--------- <br />
0 | omap3530.dsp | n | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff<br />
1 | omap3530.dap | Y | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a <br />
2 | omap3530.jrc | Y | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f<br />
<br />
(gdb) '''info registers'''<br />
r0 0x0 0<br />
r1 0x60a 1546<br />
r2 0x80000100 2147483904<br />
r3 0x706 1798 <br />
r4 0xc00081b8 3221258680<br />
r5 0x0 0 <br />
r6 0x80026960 2147641696<br />
r7 0xc00081b8 3221258680<br />
r8 0x0 0 <br />
r9 0x411fc082 1092599938<br />
r10 0x800268f8 2147641592<br />
r11 0xf731c8f9 4147235065<br />
r12 0x80796ae0 2155440864<br />
sp 0x8051a900 0x8051a900<br />
lr 0x80008018 2147516440<br />
pc 0x8000815c 0x8000815c<br />
fps 0x0 0 <br />
cpsr 0x0 0 <br />
<br />
(gdb) '''p/x $pc''' <br />
$2 = 0x8000815c <br />
<br />
(gdb) '''x/i $pc''' <br />
0x8000815c: nop (mov r0,r0)<br />
<br />
(gdb) '''x'''<br />
0x80008160: b 0x8000815c<br />
<br />
==LED blink example==<br />
<br />
Magnus Lundin has a simple standalone LED blink test program which can be used for tests.<br />
<br />
* [http://github.com/mlu/cortal_dendrites/tree/6ed04b7e838981f594eb6b701a17c220fff952dd/cortex_a8/standalone/LEDblink LED blink] test program.<br />
* [http://github.com/mlu/cortal_dendrites/blob/6ed04b7e838981f594eb6b701a17c220fff952dd/cortex_a8/standalone/LEDblink/README README]<br />
* Example .gdbinit file:<br />
<br />
echo *** Executing .gdbint to set up the environment for debugging gdb:\n<br />
<br />
# This connects to OpenOcd at localhost:3333<br />
target remote localhost:3333<br />
<br />
# omap3_dbginit must be run in OpenOCD after every reset<br />
monitor omap3_dbginit<br />
<br />
# Stop core<br />
monitor halt<br />
<br />
echo *** Environment ready, now load and start executeable:\n<br />
<br />
# Load the program executable called "LEDblink"<br />
load LEDblink<br />
<br />
# Load the symbols for the program.<br />
symbol-file LEDblink<br />
<br />
# Set a breakpoint at main().<br />
b main<br />
<br />
# Run to the breakpoint.<br />
cont<br />
<br />
Clone the code by git, goto ''cortex_a8/standalone/LEDblink'' directory, build the example using provided Makefile and then in that directory start gdb (so that above .gdbinit is executed):<br />
<br />
> '''arm-none-linux-gnueabi-gdb'''<br />
GNU gdb 6.8<br />
Copyright (C) 2008 Free Software Foundation, Inc.<br />
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html><br />
This is free software: you are free to change and redistribute it.<br />
There is NO WARRANTY, to the extent permitted by law. Type "show copying"<br />
and "show warranty" for details.<br />
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".<br />
*** Executing .gdbint to set up the environment for debugging gdb:<br />
0x00000000 in ?? ()<br />
The target may not be able to correctly handle a memory-write-packet-size<br />
of 1024 bytes. Change the packet size? (y or n) [answered Y; input not from terminal]<br />
TargetName Type Endian TapName State<br />
-- ------------------ ---------- ------ ------------------ ------------<br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown<br />
target state: halted<br />
target halted in ARM state due to debug-request, current mode: Supervisor<br />
spsr_svc: 0x600001d3 pc: 0x80008160<br />
MMU: disabled, D-Cache: disabled, I-Cache: enabled<br />
*** Environment ready, now load and start executeable:<br />
Loading section .text, size 0xe0 lma 0x82000000<br />
Start address 0x82000000, load size 224<br />
Transfer rate: 4 KB/sec, 224 bytes/write.<br />
Current language: auto; currently asm<br />
Breakpoint 1 at 0x8200003c: file LEDblink.c, line 22.<br />
<br />
Breakpoint 1, main () at LEDblink.c:22<br />
22 LEDbrightness++;<br />
Current language: auto; currently c<br />
<br />
(gdb) '''cont'''<br />
<br />
This should let Beagle's LEDs blink.<br />
<br />
=Development internals=<br />
<br />
The sections below give some datails if you are interested in developing OpenOCD for OMAP3 and Cortex A8 used on Beagle. If you like to help to improve OpenOCD support for Beagle, this might help you.<br />
<br />
==Introduction==<br />
<br />
Magnus Lundin wrote a very nice [http://arttools.blogspot.com/2009/09/debugging-on-cortex-a8-system.html introduction] on the basic Cortex A8 (OMAP3) debug architecture.<br />
<br />
==Cortex A8 support==<br />
<br />
As mentioned above, OpenOCD has initial experimental Cortex A8 support. Rick Altherr wrote (thanks!) a [https://lists.berlios.de/pipermail/openocd-development/2009-April/005273.html nice intro] how to help with Cortex A8 support for OpenOCD:<br />
<br />
''The [http://svn.berlios.de/svnroot/repos/openocd/trunk/src/target/cortex_m3.c Cortex-M3 support] is very similar to Cortex-A8 up to a certain layer. The ARM debug interface is designed as a set of layers that build on each other and can do automatic discovery. The [http://svn.berlios.de/svnroot/repos/openocd/trunk/src/target/cortex_swjdp.c cortex-swjdp] support in OpenOCD is a good start, but it assumes which AHB and APB ports are available. The first item would be to verify the cortex-swjdp portion against the documents for the CoreSight debug interface.''<br />
<br />
''To really get started, familiarize yourself with the following docs:''<br />
* ''[http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ihi0031a/index.html ARM IHI 0031A] (ARM Debug Interface v5)'' - only available to registered ARM customers<br />
* ''[http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ihi0029b/index.html ARM IHI 0029B] (CoreSight v1.0)'' - only available to registered ARM customers<br />
* ''[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0316d/DDI0316D_dap_lite_trm.pdf ARM DDI 0316D] (CoreSight DAP-Lite)''<br />
* ''[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0314f/DDI0314F_coresight_component_trm.pdf ARM DDI 0314F] (CoreSight Components TRM)''<br />
* ''[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf ARM DDI 0344H] (Cortex-A8 TRM, primarily chapter 12)''<br />
<br />
''These should be listed in the right order for getting up to speed. Basically the Cortex-A8 debug registers are accessed externally via CoreSight. CoreSight is an implementation of the ARM Debug Interface v5.''<br />
<br />
''The cortex-swjdp implementation in OpenOCD deals with CoreSight but makes some assumptions about which CoreSight components are available. For Cortex-A8, that will likely need to change a bit as the set of components will be different.''<br />
<br />
''After cortex-swjdp is patched to handle the new components, a cortex-a8 target implementation can be started by using the cortex-swjdp layer to access the various debug registers and memory locations.''<br />
<br />
For discussion about this, see [https://lists.berlios.de/pipermail/openocd-development/2009-March/005097.html mail #1], [https://lists.berlios.de/pipermail/openocd-development/2009-March/005099.html mail #2] and [https://lists.berlios.de/pipermail/openocd-development/2009-March/005117.html mail #3].<br />
<br />
Note: With revision ~1570 the cortex-swjdp module in OpenOCD has been renamed to arm_adi_v5 and updated to remove all dependencies on Cortex-M3 specific features and as far as possible only use the ARM Debug Interface v5 features. The Cortex-M3 specifics has been moved to cortex_m3 module. This is a step in preparing OpenOCD for full Cortex-A8 support. <br />
<br />
Using recent OpenOCD versions, you can examine CoreSight APs: <br />
<br />
<pre><br />
> version <br />
Open On-Chip Debugger 0.3.0-in-development (2009-08-30-19:54) svn:2643M<br />
<br />
> omap3_dbginit<br />
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)<br />
JTAG Tap/device matched<br />
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080<br />
SWJ-DP STICKY ERROR<br />
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080<br />
TargetName Type Endian TapName State<br />
-- ------------------ ---------- ------ ------------------ ------------<br />
0* omap3.cpu cortex_a8 little omap3530.dap unknown<br />
0x54011314 00000003 ....<br />
0x54011314 00000001 ....<br />
<br />
> scan_chain<br />
TapName | Enabled | IdCode Expected IrLen IrCap IrMask Instr<br />
---|--------------------|---------|------------|------------|------|------|------|---------<br />
0 | omap3530.dsp | n | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff<br />
1 | omap3530.dap | Y | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a<br />
2 | omap3530.jrc | Y | 0x00000000 | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f<br />
<br />
> dap apsel 0<br />
ap 0 selected, identification register 0x14770001<br />
<br />
> dap info 0<br />
ap identification register 0x14770001<br />
Type is mem-ap AHB <br />
ap debugbase 0xffffffff <br />
No ROM table present <br />
<br />
> dap info 1<br />
ap identification register 0x04770002<br />
Type is mem-ap APB <br />
ap debugbase 0x80000000 <br />
ROM table in legacy format<br />
CID3 0xb1, CID2 0x5, CID1 0x10, CID0, 0xd<br />
MEMTYPE system memory not present. Dedicated debug bus<br />
ROMTABLE[0x0] = 0xd4010003 <br />
Component base address 0x54010000, pid4 0x4, start address 0x54010000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21 <br />
ROMTABLE[0x4] = 0xd4011003 <br />
Component base address 0x54011000, pid4 0x4, start address 0x54011000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8 <br />
ROMTABLE[0x8] = 0xd4012003 <br />
Component base address 0x54012000, pid4 0x0, start address 0x54012000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13 <br />
ROMTABLE[0xc] = 0xd4013002 <br />
Component not present <br />
ROMTABLE[0x10] = 0xd4019003 <br />
Component base address 0x54019000, pid4 0x4, start address 0x54019000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12 <br />
ROMTABLE[0x14] = 0xd401b003 <br />
Component base address 0x5401b000, pid4 0x4, start address 0x5401b000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7 <br />
ROMTABLE[0x18] = 0xd401d003 <br />
Component base address 0x5401d000, pid4 0x0, start address 0x5401d000<br />
Component cid1 0xf0, class is Non standard layout<br />
CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd<br />
PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43<br />
ROMTABLE[0x1c] = 0xd4500003<br />
Component base address 0x54500000, pid4 0x0, start address 0x54500000<br />
Component cid1 0x90, class is CoreSight component<br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd<br />
PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20<br />
ROMTABLE[0x20] = 0x0<br />
End of ROM table<br />
<br />
> dap apsel 1<br />
ap 1 selected, identification register 0x04770002<br />
<br />
> dap apsel 2<br />
ap 2 selected, identification register 0x14760010<br />
<br />
> dap info 2<br />
ap identification register 0x14760010<br />
Type is jtag-ap<br />
ap debugbase 0x00000000<br />
No ROM table present<br />
<br />
> dap apsel 3<br />
ap 3 selected, identification register 0x00000000<br />
<br />
> dap info 3<br />
ap identification register 0x00000000<br />
No AP found at this apsel 0x3<br />
No ROM table present<br />
<br />
><br />
</pre><br />
<br />
==ROMTable==<br />
<br />
To interpret content of above ROMTable, have a look to<br />
<br />
* [http://www.ti.com/litv/pdf/spruf98b OMAP35x Technical Reference Manual (Rev. B)] (spruf98b.pdf, 39622 Kbytes), Table 5-105<br />
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0314f/DDI0314F_coresight_component_trm.pdf CoreSight Components TRM] (ARM DDI 0314F), Table 2-3<br />
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM] (ARM DDI 0344H)<br />
<br />
With this, we get (first three entries are in the MPU SS Module, address range 0x54010000 - 0x54018000, part number is given by PID1[3-0] and PID0[7-0]):<br />
<br />
ROMTABLE[0x0] = 0xd4010003 <br />
Component base address 0x54010000, pid4 0x4, start address 0x54010000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21<br />
<br />
* Part number is 0x921: ETM module. See [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM] chapter 14.<br />
<br />
ROMTABLE[0x4] = 0xd4011003 <br />
Component base address 0x54011000, pid4 0x4, start address 0x54011000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8 <br />
<br />
* Part number is 0xC08: This is the [[BeagleBoardOpenOCD#Debug_Register_Interface|Debug Register Interface]]. See table 12-3 in the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM].<br />
<br />
ROMTABLE[0x8] = 0xd4012003 <br />
Component base address 0x54012000, pid4 0x0, start address 0x54012000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13 <br />
<br />
* Part number 0x113: This is ????<br />
<br />
ROMTABLE[0x10] = 0xd4019003 <br />
Component base address 0x54019000, pid4 0x4, start address 0x54019000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12 <br />
<br />
* Part number 0x912: TPIU Module. <br />
<br />
ROMTABLE[0x14] = 0xd401b003 <br />
Component base address 0x5401b000, pid4 0x4, start address 0x5401b000<br />
Component cid1 0x90, class is CoreSight component <br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd <br />
PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7 <br />
<br />
* Part number 0x907: ETB Module.<br />
<br />
ROMTABLE[0x18] = 0xd401d003 <br />
Component base address 0x5401d000, pid4 0x0, start address 0x5401d000<br />
Component cid1 0xf0, class is Non standard layout<br />
CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd<br />
PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43<br />
<br />
* Part number 0x343: DAP CTL Module.<br />
<br />
ROMTABLE[0x1c] = 0xd4500003<br />
Component base address 0x54500000, pid4 0x0, start address 0x54500000<br />
Component cid1 0x90, class is CoreSight component<br />
CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd<br />
PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20<br />
<br />
* Part number 0x120: SDTI Module.<br />
<br />
==Debug Register Interface==<br />
<br />
With above info about debug register interface and table 12-3 in the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM] we are able to access this interface using OpenOCDs ''mdw'' command:<br />
<br />
> omap3.cpu mdw 0x54011000<br />
0x54011000 15141012<br />
<br />
This is the debug ID register. See table 12-11 of [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM]:<br />
<br />
{|border=1<br />
!Bits<br />
!Field<br />
!Value & Function<br />
|-<br />
|[31-28]<br />
|WRP<br />
|0x1 -> 2 WRPs are implemented<br />
|-<br />
|[27-24]<br />
|BRP<br />
|0x5 -> 6 BRPs are implemented<br />
|-<br />
|[23-20]<br />
|Context<br />
|0x1 -> 2 BRPs have context ID capability<br />
|-<br />
|[19-16]<br />
|Debug architecture version<br />
|0x4 -> ARMv7 debug<br />
|-<br />
|[12]<br />
|security<br />
|0x1 -> Security extensions implemented<br />
|-<br />
|[7-4]<br />
|variant<br />
|0x1<br />
|-<br />
|[3-0]<br />
|revision<br />
|0x2 <br />
|-<br />
|}<br />
<br />
> omap3.cpu mdw 0x54011FF0<br />
0x54011ff0 0000000d<br />
> omap3.cpu mdw 0x54011FF4<br />
0x54011ff4 00000090<br />
> omap3.cpu mdw 0x54011FF8<br />
0x54011ff8 00000005<br />
> omap3.cpu mdw 0x54011FFC<br />
0x54011ffc 000000b1<br />
<br />
These are the component identification registers. See table 12-51 of [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM].</div>Ichiro