Difference between revisions of "BeagleBoardOpenOCD"

From eLinux.org
Jump to: navigation, search
m (Correct link to OpenOCD configuration)
(fixing more broken indenting)
 
(32 intermediate revisions by 6 users not shown)
Line 3: Line 3:
 
[[Category:Development Boards]]
 
[[Category:Development Boards]]
 
[[Category: BeagleBoard]]
 
[[Category: BeagleBoard]]
This page is about how to use open source [http://openocd.berlios.de/web/ OpenOCD] [http://en.wikipedia.org/wiki/JTAG JTAG] software with [[BeagleBoard|BeagleBoard]]. With this, it will be possible to have OMAP3 JTAG debug using cheap [[BeagleBoardJTAG|JTAG hardware]], e.g. [[BeagleBoardJTAG#TinCanTools_Flyswatter|Flyswatter]].
+
This page is about how to use open source [http://openocd.berlios.de/web/ OpenOCD] [http://en.wikipedia.org/wiki/JTAG JTAG] software with [[BeagleBoard|BeagleBoard]] and Linux. With this, it will be possible to have OMAP3 JTAG debug using cheap [[BeagleBoardJTAG|JTAG hardware]], e.g. [[BeagleBoardJTAG#TinCanTools_Flyswatter|Flyswatter]].
  
 
'''As of September 2009, OpenOCD has basic support for OMAP3 and [[BeagleBoardOpenOCD#Cortex_A8_support|ARM Cortex A8]] on Beagle Board. Cortex A8 support is in early alpha stage, a lot is still missing. But e.g. processor halt, resume, step, breakpoints and ARM disassembly of non-Cache and non-MMU (e.g. U-Boot) applications seem to work.
 
'''As of September 2009, OpenOCD has basic support for OMAP3 and [[BeagleBoardOpenOCD#Cortex_A8_support|ARM Cortex A8]] on Beagle Board. Cortex A8 support is in early alpha stage, a lot is still missing. But e.g. processor halt, resume, step, breakpoints and ARM disassembly of non-Cache and non-MMU (e.g. U-Boot) applications seem to work.
Line 9: Line 9:
 
Status:
 
Status:
  
* You need at least OpenOCD revision '''2671''' ([[BeagleBoardOpenOCD#Build_OpenOCD|using svn]]) with some [[BeagleBoardOpenOCD#Build_OpenOCD|additional patches]]. With this revision you will have basic access to OMAP3 and Cortex A8 can be basically controlled. This does mean, that OpenOCD is able to configure scan chain correctly to [[OMAP3530_ICEPICK#ICEPICK_infos|access ARM TAP]] ("JTAG controller"), explore CoreSight AccessPoints and halt, resume, step, breakpoints and ARM disassembly on Cortex A8.
+
* You need at least OpenOCD revision '''2770''' ([[BeagleBoardOpenOCD#Build_OpenOCD|using git]]). With this revision you will have basic access to OMAP3 and Cortex A8 can be basically controlled. This does mean, that OpenOCD is able to configure scan chain correctly to [[OMAP3530_ICEPICK#ICEPICK_infos|access ARM TAP]] ("JTAG controller"), explore CoreSight AccessPoints and halt, resume, step, breakpoints and ARM disassembly on Cortex A8.
 
* Recent status as of '''September 2009''':
 
* Recent status as of '''September 2009''':
** OpenOCD >= 2671 with additional patches can and halt, resume, step, breakpoints and ARM disassembly Cortex A8 (ARM) processor on Beagle.
+
** OpenOCD >= 2770 can and halt, resume, step, breakpoints and ARM disassembly Cortex A8 (ARM) processor on Beagle.
 
** This works for non-MMU and non-Cache applications (e.g U-Boot).
 
** This works for non-MMU and non-Cache applications (e.g U-Boot).
 
** [https://lists.berlios.de/pipermail/openocd-development/2009-August/010184.html Linux debugging doesn't work yet].
 
** [https://lists.berlios.de/pipermail/openocd-development/2009-August/010184.html Linux debugging doesn't work yet].
Line 29: Line 29:
 
[http://openfacts.berlios.de/index-en.phtml?title=Building_OpenOCD OpenOCD build instructions] describe how to build [http://openocd.berlios.de/web/ OpenOCD]. For questions you can use [https://lists.berlios.de/mailman/listinfo/openocd-development OpenOCD Mailing list].
 
[http://openfacts.berlios.de/index-en.phtml?title=Building_OpenOCD OpenOCD build instructions] describe how to build [http://openocd.berlios.de/web/ OpenOCD]. For questions you can use [https://lists.berlios.de/mailman/listinfo/openocd-development OpenOCD Mailing list].
  
Get OpenOCD code via [http://subversion.tigris.org/ svn]:
+
Get OpenOCD code via git:
  
  > svn checkout svn://svn.berlios.de/openocd/trunk openocd
+
  > git clone git://openocd.git.sourceforge.net/gitroot/openocd/openocd openocd
  
'''Note''': On top of revision 2671 the following patches are required:
+
For Flyswatter you additionally need [http://www.ftdichip.com/Drivers/D2XX.htm libftd2xx] or [http://www.intra2net.com/de/produkte/opensource/ftdi/ libFTDI]. While libFTDI is available in source, libftd2xx is supposed to be 50% [http://www.beagleboard.org/irclogs/index.php?date=2008-10-16#T16:06:22 faster] than libFTDI. The libtfd2xx binaries are available both as shared library or linkable archive.
# '''[https://lists.berlios.de/pipermail/openocd-development/2009-August/010110.html tck100 patch]'''
+
# '''[https://lists.berlios.de/pipermail/openocd-development/2009-September/010335.html Improved thumb state handling]'''
+
  
For Flyswatter you additionally need [http://www.ftdichip.com/Drivers/D2XX.htm libftd2xx] or [http://www.intra2net.com/de/produkte/opensource/ftdi/ libFTDI]. While libFTDI is available in source, libftd2xx is supposed to be 50% [http://www.beagleboard.org/irclogs/index.php?date=2008-10-16#T16:06:22 faster] than libFTDI. The libtfd2xx binaries are available booth as shared library or linkable archive.
+
If you downloaded OpenOCD git and have libftd2xx or libFTDI, build OpenOCD (assuming you extracted/built FTDI library already):
 
+
If you downloaded OpenOCD svn and have libftd2xx or libFTDI, build OpenOCD (assuming you extracted/built FTDI library already):
+
 
   
 
   
 
  > cd openocd
 
  > cd openocd
Line 48: Line 44:
 
  > make
 
  > make
 
  > make install
 
  > make install
 +
 +
When compiling the doc directory You get an error:
 +
openocd.texi:12: @include `version.texi': No such file or directory.
 +
It is possible to avoid by making version.texi.
 +
 +
> cat doc/version.texi
 +
@set UPDATED 20 January 2009
 +
@set UPDATED-MONTH January 2009
 +
@set EDITION 0.1.0
 +
@set VERSION 0.1.0
  
 
'''Note''': By default (make & make install) only .info documentation is installed. You can get PDF or HTML documentation by
 
'''Note''': By default (make & make install) only .info documentation is installed. You can get PDF or HTML documentation by
Line 88: Line 94:
  
 
  > '''openocd -s lib/openocd/ -f interface/flyswatter.cfg -f board/ti_beagleboard.cfg'''
 
  > '''openocd -s lib/openocd/ -f interface/flyswatter.cfg -f board/ti_beagleboard.cfg'''
  Open On-Chip Debugger 0.3.0-in-development (2009-09-04-10:01) svn:2671M 
+
  Open On-Chip Debugger 0.5.0-dev-00141-g33e5dd1 (2010-04-02-11:14)
  $URL: svn://svn.berlios.de/openocd/trunk/src/openocd.c $
+
  Licensed under GNU GPL v2
  For bug reports, read http://svn.berlios.de/svnroot/repos/openocd/trunk/BUGS
+
  For bug reports, read
  RCLK - adaptive                                                                                            
+
        http://openocd.berlios.de/doc/doxygen/bugs.html
  Warn : huge IR length 38                                                                                  
+
  RCLK - adaptive
  Info : RCLK (adaptive clock speed) not supported - fallback to 6000 kHz
+
  Warn : omap3530.dsp: huge IR length 38
 +
RCLK - adaptive
 +
trst_only separate trst_push_pull
 +
  Info : RCLK (adaptive clock speed) not supported - fallback to 1000 kHz
 
  Info : JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)
 
  Info : JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)
 +
Info : JTAG tap: omap3530.dap enabled
 +
Info : omap3530.cpu: hardware has 6 breakpoints, 2 watchpoints
  
This shows that your (Flyswatter) JTAG dongle basically works and that you are able to see OMAP3 JRC. OpenOCD now runs as deamon.
+
This shows that your (Flyswatter) JTAG dongle basically works and that you are able to see OMAP3 JRC. OpenOCD now runs as daemon.
  
 
=Controlling OpenOCD=
 
=Controlling OpenOCD=
  
Once OpenOCD runs as [http://openocd.berlios.de/doc/Running.html#Running daemon] like above, you can connect using ''telnet'' or ''GDB''
+
Once OpenOCD runs as [http://openocd.berlios.de/doc/html/Running.html#Running daemon] like above, you can connect using ''telnet'' or ''GDB''
  
 
==telnet==
 
==telnet==
Line 282: Line 293:
 
==Example session==
 
==Example session==
  
Now, we can try to basically halt and resume OMAP3 (assuming U-Boot is running at U-Boot's prompt):
+
Now, we can try to basically halt and resume OMAP3 (assuming U-Boot is running at U-Boot's prompt), before doing anything, call omap_dbginit:
  
> '''omap3_dbginit'''
+
> '''omap3_dbginit omap3530.cpu'''
 +
cortex_a8_mmu: target not halted
 +
 
 +
Make sure when you halt, the PC shows you're somewhere in u-boot (0x80eXXXXX):
 +
 
 +
> '''halt'''
 +
target state: halted
 +
target halted in ARM state due to debug-request, current mode: Supervisor
 +
cpsr: 0x400001d3 pc: 0x80e880dc
 +
MMU: disabled, D-Cache: disabled, I-Cache: enabled
 +
 
 +
> '''reset halt'''
 +
RCLK not supported - fallback to 1000 kHz
 
  JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)
 
  JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)
  JTAG Tap/device matched
+
  JTAG tap: omap3530.dap enabled
  AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080
+
  omap3530.cpu: ran after reset and before halt ...
  SWJ-DP STICKY ERROR
+
  target state: halted
  Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080
+
  target halted in ARM state due to debug-request, current mode: Supervisor
    TargetName        Type      Endian TapName            State
+
cpsr: 0x800001d3 pc: 0x40202994
  -- ------------------ ---------- ------ ------------------ ------------
+
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
0* omap3.cpu          cortex_a8  little omap3530.dap      unknown
+
0x54011314 00000003                            ....
+
0x54011314 00000001                            ....
+
 
   
 
   
> '''scan_chain'''
+
> '''scan_chain'''
      TapName           | Enabled IdCode     Expected   IrLen IrCap IrMask Instr
+
    TapName             Enabled IdCode     Expected   IrLen IrCap IrMask
  ---|--------------------|---------|------------|------------|------|------|------|---------
+
  -- ------------------- -------- ---------- ---------- ----- ----- ------
   0 | omap3530.dsp       |    n   | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff
+
   0 omap3530.dsp           n     0x00000000 0x00000000   38 0x25 0x3f
   1 | omap3530.dap       |    Y   | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a
+
   1 omap3530.dap           Y     0x00000000 0x0b6d602f     4 0x01 0x0f
   2 | omap3530.jrc       |    Y   | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f
+
   2 omap3530.jrc           Y     0x0b7ae02f 0x0b7ae02f     6 0x01 0x3f
 
   
 
   
  > '''halt'''
+
> '''resume'''
 +
   
 +
> '''poll'''
 +
background polling: on
 +
TAP: omap3530.dap (enabled)
 +
target state: running
 +
 +
> '''halt'''
 
  target state: halted
 
  target state: halted
 
  target halted in ARM state due to debug-request, current mode: Supervisor
 
  target halted in ARM state due to debug-request, current mode: Supervisor
Line 309: Line 336:
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
   
 
   
> '''poll'''
+
> '''poll'''
 
  background polling: on
 
  background polling: on
 
  TAP: omap3530.dap (enabled)
 
  TAP: omap3530.dap (enabled)
Line 317: Line 344:
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
   
 
   
  > '''resume'''
+
> '''reg'''                                                                                 
 +
  ===== ARM registers                                                                   
 +
(0) r0 (/32): 0x49020000 (dirty)                                                       
 +
(1) r1 (/32): 0x00000003                                                               
 +
(2) r2 (/32): 0x00000001                                                               
 +
(3) r3 (/32): 0x00000060                                                               
 +
(4) r4 (/32): 0x00000055                                                               
 +
(5) r5 (/32): 0x80EAC204                                                               
 +
(6) r6 (/32): 0x80EAC204
 +
(7) r7 (/32): 0x80EA7985
 +
(8) r8 (/32): 0x80E3FFDC
 +
(9) r9 (/32): 0x00000002
 +
(10) r10 (/32): 0x00000018
 +
(11) r11 (/32): 0x00000000
 +
(12) r12 (/32): 0x00000000
 +
(13) sp_usr (/32)
 +
(14) lr_usr (/32)
 +
(15) pc (/32): 0x80E87F1C
 +
(16) r8_fiq (/32)
 +
(17) r9_fiq (/32)
 +
(18) r10_fiq (/32)
 +
(19) r11_fiq (/32)
 +
(20) r12_fiq (/32)
 +
(21) sp_fiq (/32)
 +
(22) lr_fiq (/32)
 +
(23) sp_irq (/32)
 +
(24) lr_irq (/32)
 +
(25) sp_svc (/32): 0x80E3FE80
 +
(26) lr_svc (/32): 0x80E87D7C
 +
(27) sp_abt (/32)
 +
(28) lr_abt (/32)
 +
(29) sp_und (/32)
 +
(30) lr_und (/32)
 +
(31) cpsr (/32): 0x400001D3
 +
(32) spsr_fiq (/32)
 +
(33) spsr_irq (/32)
 +
(34) spsr_svc (/32)
 +
(35) spsr_abt (/32)
 +
(36) spsr_und (/32)
 +
(37) sp_mon (/32)
 +
(38) lr_mon (/32)
 +
(39) spsr_mon (/32)
 +
 +
> '''resume'''
 
   
 
   
> '''poll'''
+
> '''poll'''
 
  background polling: on
 
  background polling: on
 
  TAP: omap3530.dap (enabled)
 
  TAP: omap3530.dap (enabled)
 
  target state: running
 
  target state: running
 
   
 
   
> '''soft_reset_halt'''
+
> '''soft_reset_halt'''
 
  requesting target halt and executing a soft reset
 
  requesting target halt and executing a soft reset
 
  Target omap3.cpu does not support soft_reset_halt
 
  Target omap3.cpu does not support soft_reset_halt
 
   
 
   
> '''cortex_a8 cache_info'''
+
> '''cortex_a8 cache_info'''
 
  cache type: 0x0, unified cache
 
  cache type: 0x0, unified cache
 
  D-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400
 
  D-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400
 
  I-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400
 
  I-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400
 
   
 
   
> '''halt'''                                                                           
+
> '''halt'''                                                                           
 
  target state: halted                                                                     
 
  target state: halted                                                                     
 
  target halted in ARM state due to debug-request, current mode: Supervisor
 
  target halted in ARM state due to debug-request, current mode: Supervisor
Line 339: Line 409:
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
   
 
   
> '''armv4_5 disassemble 0x80e88158 10'''
+
> '''arm disassemble 0x80e88158 10'''
 
  0x80e88158      0xe3130001      TST r3, #0x1
 
  0x80e88158      0xe3130001      TST r3, #0x1
 
  0x80e8815c      0x0afffffc      BEQ 0x80e88154
 
  0x80e8815c      0x0afffffc      BEQ 0x80e88154
Line 351: Line 421:
 
  0x80e8817c      0xe59f0000      LDR r0, [r15]
 
  0x80e8817c      0xe59f0000      LDR r0, [r15]
 
   
 
   
> '''step'''
+
> '''step'''
 
  target state: halted
 
  target state: halted
 
  target halted in ARM state due to breakpoint, current mode: Supervisor
 
  target halted in ARM state due to breakpoint, current mode: Supervisor
Line 357: Line 427:
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
   
 
   
> '''step'''
+
> '''step'''
 
  target state: halted
 
  target state: halted
 
  target halted in ARM state due to breakpoint, current mode: Supervisor
 
  target halted in ARM state due to breakpoint, current mode: Supervisor
Line 363: Line 433:
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
   
 
   
> '''bp 0x80e88160 4 hw'''
+
> '''bp 0x80e88160 4 hw'''
 
  breakpoint set at 0x80e88160
 
  breakpoint set at 0x80e88160
 
   
 
   
> '''resume'''
+
> '''resume'''
 
    
 
    
 
  ''... type anything in U-Boot until breakpoint is hit ...''
 
  ''... type anything in U-Boot until breakpoint is hit ...''
Line 375: Line 445:
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
  MMU: disabled, D-Cache: disabled, I-Cache: enabled
 
   
 
   
> '''bp'''
+
> '''bp'''
 
  0x80e88160, 0x4, 1
 
  0x80e88160, 0x4, 1
 
   
 
   
> '''rbp 0x80e88160'''
+
> '''rbp 0x80e88160'''
 
   
 
   
> '''resume'''
+
> '''resume'''
 
+
==GDB==
+
 
+
tbd.
+
  
 
=GDB ARM=
 
=GDB ARM=
  
To [[DebuggingTheLinuxKernelUsingGdb|debug]] an ARM target with GNU debugger ([[GDB|GDB]]), you need a GDB understanding ARM processor. If your ARM cross compilation tool chain doesn't include a GDB, you can easily build it your self.
+
To [[Debugging The Linux Kernel Using Gdb|debug]] an ARM target with GNU debugger ([[GDB]]), you need a GDB understanding ARM processor. If your ARM cross compilation tool chain doesn't include a GDB, you can easily build it your self.
 +
 
 +
==Build==
  
 
* Download latest [http://www.gnu.org/software/gdb/download/ GDB sources]. [http://openocd.berlios.de/doc/GDB-and-OpenOCD.html#GDB-and-OpenOCD OpenOCD docu] recommends to use GDB 6.7 or newer. Here, we use GDB 6.8 which is the recent version while writing this.
 
* Download latest [http://www.gnu.org/software/gdb/download/ GDB sources]. [http://openocd.berlios.de/doc/GDB-and-OpenOCD.html#GDB-and-OpenOCD OpenOCD docu] recommends to use GDB 6.7 or newer. Here, we use GDB 6.8 which is the recent version while writing this.
Line 417: Line 485:
 
  This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".
 
  This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".
 
  (gdb)
 
  (gdb)
 +
 +
==Example session==
 +
 +
To use gdb, you have to connect to running OpenOCD using remote command. E.g.:
 +
 +
> '''arm-none-linux-gnueabi-gdb'''
 +
GNU gdb 6.8
 +
Copyright (C) 2008 Free Software Foundation, Inc.
 +
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 +
This is free software: you are free to change and redistribute it.
 +
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
 +
and "show warranty" for details.
 +
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".
 +
 +
(gdb) '''target remote localhost:3333'''
 +
Remote debugging using localhost:3333
 +
0x00000000 in ?? ()                 
 +
(gdb) '''monitor omap3_dbginit'''         
 +
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)
 +
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080             
 +
SWJ-DP STICKY ERROR                                                                   
 +
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080                                     
 +
    TargetName        Type      Endian TapName            State                     
 +
--  ------------------ ---------- ------ ------------------ ------------               
 +
  0* omap3.cpu          cortex_a8  little omap3530.dap      unknown                   
 +
0x54011314 00000003                            ....                                   
 +
0x54011314 00000001                            ....       
 +
                             
 +
(gdb) '''monitor scan_chain'''                                                               
 +
    TapName            | Enabled |  IdCode      Expected    IrLen IrCap  IrMask Instr   
 +
---|--------------------|---------|------------|------------|------|------|------|---------
 +
  0 | omap3530.dsp      |    n    | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff
 +
  1 | omap3530.dap      |    Y    | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a     
 +
  2 | omap3530.jrc      |    Y    | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f
 +
 +
(gdb) '''info registers'''
 +
r0            0x0      0
 +
r1            0x60a    1546
 +
r2            0x80000100      2147483904
 +
r3            0x706    1798             
 +
r4            0xc00081b8      3221258680
 +
r5            0x0      0               
 +
r6            0x80026960      2147641696
 +
r7            0xc00081b8      3221258680
 +
r8            0x0      0               
 +
r9            0x411fc082      1092599938
 +
r10            0x800268f8      2147641592
 +
r11            0xf731c8f9      4147235065
 +
r12            0x80796ae0      2155440864
 +
sp            0x8051a900      0x8051a900
 +
lr            0x80008018      2147516440
 +
pc            0x8000815c      0x8000815c
 +
fps            0x0      0               
 +
cpsr          0x0      0 
 +
               
 +
(gdb) '''p/x $pc'''                             
 +
$2 = 0x8000815c                           
 +
 +
(gdb) '''x/i $pc'''                             
 +
0x8000815c:    nop                    (mov r0,r0)
 +
 +
(gdb) '''x'''
 +
0x80008160:    b      0x8000815c
 +
 +
==LED blink example==
 +
 +
Magnus Lundin has a simple standalone LED blink test program which can be used for tests.
 +
 +
*  [http://github.com/mlu/cortal_dendrites/tree/6ed04b7e838981f594eb6b701a17c220fff952dd/cortex_a8/standalone/LEDblink LED blink] test program.
 +
* [http://github.com/mlu/cortal_dendrites/blob/6ed04b7e838981f594eb6b701a17c220fff952dd/cortex_a8/standalone/LEDblink/README README]
 +
* Example .gdbinit file:
 +
 +
echo *** Executing .gdbint to set up the environment for debugging gdb:\n
 +
 +
# This connects to OpenOcd at localhost:3333
 +
target remote localhost:3333
 +
 +
# omap3_dbginit must be run in OpenOCD after every reset
 +
monitor omap3_dbginit
 +
 +
# Stop core
 +
monitor halt
 +
 +
echo *** Environment ready, now load and start executeable:\n
 +
 +
# Load the program executable called "LEDblink"
 +
load LEDblink
 +
 +
# Load the symbols for the program.
 +
symbol-file LEDblink
 +
 +
# Set a breakpoint at main().
 +
b main
 +
 +
# Run to the breakpoint.
 +
cont
 +
 +
Clone the code by git, goto ''cortex_a8/standalone/LEDblink'' directory, build the example using provided Makefile and then in that directory start gdb (so that above .gdbinit is executed):
 +
 +
> '''arm-none-linux-gnueabi-gdb'''
 +
GNU gdb 6.8
 +
Copyright (C) 2008 Free Software Foundation, Inc.
 +
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 +
This is free software: you are free to change and redistribute it.
 +
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
 +
and "show warranty" for details.
 +
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".
 +
*** Executing .gdbint to set up the environment for debugging gdb:
 +
0x00000000 in ?? ()
 +
The target may not be able to correctly handle a memory-write-packet-size
 +
of 1024 bytes. Change the packet size? (y or n) [answered Y; input not from terminal]
 +
    TargetName        Type      Endian TapName            State
 +
--  ------------------ ---------- ------ ------------------ ------------
 +
  0* omap3.cpu          cortex_a8  little omap3530.dap      unknown
 +
target state: halted
 +
target halted in ARM state due to debug-request, current mode: Supervisor
 +
spsr_svc: 0x600001d3 pc: 0x80008160
 +
MMU: disabled, D-Cache: disabled, I-Cache: enabled
 +
*** Environment ready, now load and start executeable:
 +
Loading section .text, size 0xe0 lma 0x82000000
 +
Start address 0x82000000, load size 224
 +
Transfer rate: 4 KB/sec, 224 bytes/write.
 +
Current language:  auto; currently asm
 +
Breakpoint 1 at 0x8200003c: file LEDblink.c, line 22.
 +
 +
Breakpoint 1, main () at LEDblink.c:22
 +
22                      LEDbrightness++;
 +
Current language:  auto; currently c
 +
 +
(gdb) '''cont'''
 +
 +
This should let Beagle's LEDs blink.
  
 
=Development internals=
 
=Development internals=
  
 
The sections below give some datails if you are interested in developing OpenOCD for OMAP3 and Cortex A8 used on Beagle. If you like to help to improve OpenOCD support for Beagle, this might help you.
 
The sections below give some datails if you are interested in developing OpenOCD for OMAP3 and Cortex A8 used on Beagle. If you like to help to improve OpenOCD support for Beagle, this might help you.
 +
 +
==Introduction==
 +
 +
Magnus Lundin wrote a very nice [http://arttools.blogspot.com/2009/09/debugging-on-cortex-a8-system.html introduction] on the basic Cortex A8 (OMAP3) debug architecture.
  
 
==Cortex A8 support==
 
==Cortex A8 support==
Line 669: Line 873:
  
 
These are the component identification registers. See table 12-51 of [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM].
 
These are the component identification registers. See table 12-51 of [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344h/DDI0344H_cortex_a8_r3p0_trm.pdf Cortex-A8 TRM].
 +
 +
[[Category:OpenOCD]]

Latest revision as of 18:07, 12 August 2012

This page is about how to use open source OpenOCD JTAG software with BeagleBoard and Linux. With this, it will be possible to have OMAP3 JTAG debug using cheap JTAG hardware, e.g. Flyswatter.

As of September 2009, OpenOCD has basic support for OMAP3 and ARM Cortex A8 on Beagle Board. Cortex A8 support is in early alpha stage, a lot is still missing. But e.g. processor halt, resume, step, breakpoints and ARM disassembly of non-Cache and non-MMU (e.g. U-Boot) applications seem to work.

Status:

  • You need at least OpenOCD revision 2770 (using git). With this revision you will have basic access to OMAP3 and Cortex A8 can be basically controlled. This does mean, that OpenOCD is able to configure scan chain correctly to access ARM TAP ("JTAG controller"), explore CoreSight AccessPoints and halt, resume, step, breakpoints and ARM disassembly on Cortex A8.
  • Recent status as of September 2009:
    • OpenOCD >= 2770 can and halt, resume, step, breakpoints and ARM disassembly Cortex A8 (ARM) processor on Beagle.
    • This works for non-MMU and non-Cache applications (e.g U-Boot).
    • Linux debugging doesn't work yet.


Hardware

To be able to use OpenOCD with OMAP3 based BeagleBoard, make sure that your JTAG Dongle supports:

  • 1.8V devices. Many JTAG dongles are 3.3V only! Verify that your dongle supports 1.8V! Else the dongle will overpowering the input to OMAP3 and may cause damage.
  • Your JTAG dongle is able to switch EMU0 & EMU1 pins high.

Flyswatter dongle supports both requirements. If you use BeagleBoard Adapter Kit with Flyswatter, make sure you plug the JTAG adapter the correct way. There are several possible ways, though. See connection picture how to do it the right way. In contrast to the picture EMU0 & EMU1 jumpers at JTAG adapter should be both at 1-2 position (touching J2).

Build OpenOCD

OpenOCD build instructions describe how to build OpenOCD. For questions you can use OpenOCD Mailing list.

Get OpenOCD code via git:

> git clone git://openocd.git.sourceforge.net/gitroot/openocd/openocd openocd

For Flyswatter you additionally need libftd2xx or libFTDI. While libFTDI is available in source, libftd2xx is supposed to be 50% faster than libFTDI. The libtfd2xx binaries are available both as shared library or linkable archive.

If you downloaded OpenOCD git and have libftd2xx or libFTDI, build OpenOCD (assuming you extracted/built FTDI library already):

> cd openocd
> ./bootstrap
> ./configure --enable-ft2232_ftd2xx --with-ftd2xx-linux-tardir=<path_to>/libftd2xx0.4.16 --prefix=/home/user/bin/openOCD
or (depending which FTDI library you use, see above)
> ./configure --enable-ft2232_libftdi --prefix=/home/user/bin/openOCD
> make
> make install

When compiling the doc directory You get an error: openocd.texi:12: @include `version.texi': No such file or directory. It is possible to avoid by making version.texi.

> cat doc/version.texi
@set UPDATED 20 January 2009
@set UPDATED-MONTH January 2009
@set EDITION 0.1.0
@set VERSION 0.1.0

Note: By default (make & make install) only .info documentation is installed. You can get PDF or HTML documentation by

make pdf

or

make html

Resulting documentation can be found in openocd/doc, then.

Note: If you like to save some disk space and don't plan to debug OpenOCD binary itself, you can strip this (remove unneeded debug symbols):

> cd <openocd_install_dir>/bin
> strip openocd

(e.g. with OpenOCD 1.0 this reduced binary size from ~3MB to ~700kB)

Note: If you don't have libftdi in standard path, you might like to extend library search path:

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<path_to>/lib

if you e.g. get

> ./openocd
./openocd: error while loading shared libraries: libftdi.so.1: cannot open shared object file: No such file or directory

Starting OpenOCD

OpenOCD runtime is controlled by several configuration files. OpenOCD comes with basic configuration files for BeagleBoard (board/ti_beagleboard.cfg) and OMAP3 (target/omap3530.cfg).

Assuming that you use Flyswatter and it is switched on (attached to USB), you can now start OpenOCD with:

openocd -s <path_to_config_files>   // e.g. <path_of_openocd_install_dir>/lib/openocd
        -f <path_to_jtag_interface>
        -f <path_to_beagle_config>

This should result in

> openocd -s lib/openocd/ -f interface/flyswatter.cfg -f board/ti_beagleboard.cfg
Open On-Chip Debugger 0.5.0-dev-00141-g33e5dd1 (2010-04-02-11:14)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.berlios.de/doc/doxygen/bugs.html
RCLK - adaptive
Warn : omap3530.dsp: huge IR length 38
RCLK - adaptive
trst_only separate trst_push_pull
Info : RCLK (adaptive clock speed) not supported - fallback to 1000 kHz
Info : JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)
Info : JTAG tap: omap3530.dap enabled
Info : omap3530.cpu: hardware has 6 breakpoints, 2 watchpoints

This shows that your (Flyswatter) JTAG dongle basically works and that you are able to see OMAP3 JRC. OpenOCD now runs as daemon.

Controlling OpenOCD

Once OpenOCD runs as daemon like above, you can connect using telnet or GDB

telnet

Connect to OpenOCD daemon. Assuming you do it on your local machine, open a second terminal window and do (assuming port 4444 as configured in above openocd.cfg):

> telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> 

This should give you

Info:   accepting 'telnet' connection from 0

in window where OpenOCD daemon is started.

At OpenOCDs telnet prompt you can now issue OpenOCD commands. E.g. help should result in

> help                                 
bp                        list or set breakpoint [<address> <length> [hw]]
cpu                       <name> - prints out target options and a comment 
                          on CPU which matches name                        
debug_level               adjust debug level <0-3>                         
drscan                    execute DR scan <device> <num_bits> <value>      
                          <num_bits1> <value2> ...                         
dump_image                dump_image <file> <address> <size>               
exit                      exit telnet session                              
fast                      fast <enable/disable> - place at beginning of    
                          config files. Sets defaults to fast and dangerous.
                                                                           
fast_load                 loads active fast load image to current target -  
                          mainly for profiling purposes                     
fast_load_image           same args as load_image, image stored in memory - 
                          mainly for profiling purposes                     
find                      <file> - print full path to file according to     
                          OpenOCD search rules                              
flush_count               returns number of times the JTAG queue has been   
                          flushed                                           
ft2232_device_desc        the USB device description of the FTDI FT2232     
                          device                                            
ft2232_latency            set the FT2232 latency timer to a new value       
ft2232_layout             the layout of the FT2232 GPIO signals used to     
                          control output-enables and reset signals          
ft2232_serial             the serial number of the FTDI FT2232 device       
ft2232_vid_pid            the vendor ID and product ID of the FTDI FT2232   
                          device                                            
gdb_breakpoint_override   hard/soft/disable - force breakpoint type for gdb 
                          'break' commands.                                 
gdb_detach                resume/reset/halt/nothing - specify behavior when 
                          GDB detaches from the target                      
gdb_flash_program         enable or disable flash program                   
gdb_memory_map            enable or disable memory map                      
gdb_port                  daemon configuration command gdb_port             
gdb_report_data_abort     enable or disable reporting data aborts           
halt                      halt target                                       
help                      Tcl implementation of help command                
init                      initializes target and servers - nop on subsequent 
                          invocations                                        
interface                 try to configure interface                         
interface_list            list all built-in interfaces                       
irscan                    execute IR scan <device> <instr> [dev2] [instr2]   
                          ...                                                
jtag                      perform jtag tap actions                           
jtag_device               (DEPRECATED) jtag_device <ir_length> <ir_expected> 
                          <ir_mask>                                          
jtag_khz                  set maximum jtag speed (if supported); parameter   
                          is maximum khz, or 0 for adaptive clocking (RTCK). 
                                                                            
jtag_nsrst_delay          jtag_nsrst_delay <ms> - delay after deasserting    
                          srst in ms                                         
jtag_ntrst_delay          jtag_ntrst_delay <ms> - delay after deasserting    
                          trst in ms                                         
jtag_rclk                 fallback_speed_khz - set JTAG speed to RCLK or use 
                          fallback speed                                     
jtag_reset                toggle reset lines <trst> <srst>                   
jtag_speed                (DEPRECATED) set jtag speed (if supported)         
load_image                load_image <file> <address>                        
                          ['bin'|'ihex'|'elf'|'s19'] [min_address]           
                          [max_length]                                       
log_output                redirect logging to <file> (default: stderr)       
mdb                       display memory bytes <addr> [count]                
mdh                       display memory half-words <addr> [count]           
mdw                       display memory words <addr> [count]                
mwb                       write memory byte <addr> <value> [count]           
mwh                       write memory half-word <addr> <value> [count]      
mww                       write memory word <addr> <value> [count]           
ocd_array2mem             convert a TCL array to memory locations and write  
                          the values  <ARRAYNAME> <WIDTH = 32/16/8>          
                          <ADDRESS> <COUNT>                                  
ocd_flash_banks           return information about the flash banks           
ocd_mem2array             read memory and return as a TCL array for script   
                          processing <ARRAYNAME> <WIDTH = 32/16/8> <ADDRESS> 
                          <COUNT>                                            
pathmove                  move JTAG to state1 then to state2, state3, etc.   
                          <state1>,<state2>,<stat3>...                       
poll                      poll target state                                  
power_restore             Overridable procedure run when power restore is    
                          detected. Runs 'reset init' by default.            
production                <serialnumber> - Runs production procedure. Throws 
                          exception if procedure failed. Prints progress     
                          messages. Implement this procedure in the target   
                          script.                                            
production                Runs test procedure. Throws exception if procedure 
                          failed. Prints progress messages. Implement in     
                          target script.                                     
production_info           Displays information on production procedure for   
                          target script. Implement this procedure in target  
                          script.                                            
profile                   profiling samples the CPU PC                       
rbp                       remove breakpoint <address>                        
reg                       display or set a register                          
reset                     reset target [run | halt | init] - default is run  
reset_config              [none/trst_only/srst_only/trst_and_srst]           
                          [srst_pulls_trst/trst_pulls_srst]                  
                          [combined/separate]                                
                          [trst_push_pull/trst_open_drain]                   
                          [srst_push_pull/srst_open_drain]                   
resume                    resume target [addr]                               
runtest                   move to Run-Test/Idle, and execute <num_cycles>    
rwp                       remove watchpoint <address>                        
scan_chain                print current scan chain configuration             
script                    <filename> - filename of OpenOCD script (tcl) to   
                          run                                                
shutdown                  shut the server down                               
sleep                     <n> [busy] - sleep for n milliseconds. "busy"      
                          means busy wait                                    
soft_reset_halt           halt the target and do a soft reset                
srst_deasserted           Overridable procedure run when srst deassert is    
                          detected. Runs 'reset init' by default.            
step                      step one instruction from current PC or [addr]     
svf                       run svf <file>                                     
target                    configure target                                   
targets                   change the current command line target (one        
                          parameter) or lists targets (with no parameter)    
tcl_port                  port on which to listen for incoming TCL syntax    
telnet_port               port on which to listen for incoming telnet        
                          connections                                        
test_image                test_image <file> [offset] [type]                  
tms_sequence              choose short(default) or long tms_sequence <short  
                          | long>                                            
verify_image              verify_image <file> [offset] [type]                
verify_ircapture          verify value captured during Capture-IR <enable |
                          disable>
verify_jtag               verify value capture <enable | disable>
version                   show OpenOCD version
virt2phys                 translate a virtual address into a physical
                          address
wait_halt                 wait for target halt [time (s)]
wp                        list or set watchpoint [<address> <length> <r/w/a>
                          [value] [mask]]
xsvf                      run xsvf <file> [virt2] [quiet]
armv4_5 core_state        display/change ARM core state <arm | thumb>
armv4_5 disassemble       disassemble instructions <address> [<count>
                          ['thumb']]
armv4_5 reg               display ARM core registers
cortex_a8 cache_info      display information about target caches
dap apid                  return id reg from AP [num], default currently
                          selected AP
dap apsel                 select a different AP [num] (default 0)
dap baseaddr              return debug base address from AP [num], default
                          currently selected AP
dap info                  dap info for ap [num], default currently selected
                          AP
dap memaccess             set/get number of extra tck for mem-ap memory bus
                          access [0-255]
flash bank                flash bank <driver> <base> <size> <chip_width>
                          <bus_width> <target> [driver_options ...]
mflash bank               mflash bank <soc> <base> <RST pin> <target #>
nand device
pld device
target_request debugmsgs  enable/disable reception of debug messages from
                          target
trace history             display trace history, ['clear'] history or set
                          [size]
trace point               display trace points, ['clear'] list of trace
                          points, or add new tracepoint at [address]

Example session

Now, we can try to basically halt and resume OMAP3 (assuming U-Boot is running at U-Boot's prompt), before doing anything, call omap_dbginit:

> omap3_dbginit omap3530.cpu

cortex_a8_mmu: target not halted

Make sure when you halt, the PC shows you're somewhere in u-boot (0x80eXXXXX):

> halt

target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x400001d3 pc: 0x80e880dc
MMU: disabled, D-Cache: disabled, I-Cache: enabled

> reset halt

RCLK not supported - fallback to 1000 kHz
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)
JTAG tap: omap3530.dap enabled
omap3530.cpu: ran after reset and before halt ...
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x800001d3 pc: 0x40202994
MMU: disabled, D-Cache: disabled, I-Cache: enabled

> scan_chain

   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 omap3530.dsp           n     0x00000000 0x00000000    38 0x25  0x3f
 1 omap3530.dap           Y     0x00000000 0x0b6d602f     4 0x01  0x0f
 2 omap3530.jrc           Y     0x0b7ae02f 0x0b7ae02f     6 0x01  0x3f

> resume

> poll

background polling: on
TAP: omap3530.dap (enabled)
target state: running

> halt

target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
spsr_svc: 0x400001d3 pc: 0x80e87dcc
MMU: disabled, D-Cache: disabled, I-Cache: enabled

> poll

background polling: on
TAP: omap3530.dap (enabled)
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
spsr_svc: 0x400001d3 pc: 0x80e87dcc
MMU: disabled, D-Cache: disabled, I-Cache: enabled

> reg

===== ARM registers                                                                     
(0) r0 (/32): 0x49020000 (dirty)                                                        
(1) r1 (/32): 0x00000003                                                                
(2) r2 (/32): 0x00000001                                                                
(3) r3 (/32): 0x00000060                                                                
(4) r4 (/32): 0x00000055                                                                
(5) r5 (/32): 0x80EAC204                                                                
(6) r6 (/32): 0x80EAC204
(7) r7 (/32): 0x80EA7985
(8) r8 (/32): 0x80E3FFDC
(9) r9 (/32): 0x00000002
(10) r10 (/32): 0x00000018
(11) r11 (/32): 0x00000000
(12) r12 (/32): 0x00000000
(13) sp_usr (/32)
(14) lr_usr (/32)
(15) pc (/32): 0x80E87F1C
(16) r8_fiq (/32)
(17) r9_fiq (/32)
(18) r10_fiq (/32)
(19) r11_fiq (/32)
(20) r12_fiq (/32)
(21) sp_fiq (/32)
(22) lr_fiq (/32)
(23) sp_irq (/32)
(24) lr_irq (/32)
(25) sp_svc (/32): 0x80E3FE80
(26) lr_svc (/32): 0x80E87D7C
(27) sp_abt (/32)
(28) lr_abt (/32)
(29) sp_und (/32)
(30) lr_und (/32)
(31) cpsr (/32): 0x400001D3
(32) spsr_fiq (/32)
(33) spsr_irq (/32)
(34) spsr_svc (/32)
(35) spsr_abt (/32)
(36) spsr_und (/32)
(37) sp_mon (/32)
(38) lr_mon (/32)
(39) spsr_mon (/32)

> resume

> poll

background polling: on
TAP: omap3530.dap (enabled)
target state: running

> soft_reset_halt

requesting target halt and executing a soft reset
Target omap3.cpu does not support soft_reset_halt

> cortex_a8 cache_info

cache type: 0x0, unified cache
D-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400
I-Cache: linelen 8, associativity 2, nsets 64, cachesize 0x400

> halt

target state: halted                                                                    
target halted in ARM state due to debug-request, current mode: Supervisor
spsr_svc: 0x400001d3 pc: 0x80e88158
MMU: disabled, D-Cache: disabled, I-Cache: enabled

> arm disassemble 0x80e88158 10

0x80e88158      0xe3130001      TST r3, #0x1
0x80e8815c      0x0afffffc      BEQ 0x80e88154
0x80e88160      0xe5d00000      LDRB r0, [r0]
0x80e88164      0xe12fff1e      BX r14
0x80e88168      0xe5d00014      LDRB r0, [r0, #0x14]
0x80e8816c      0xe2000001      AND r0, r0, #0x1
0x80e88170      0xe12fff1e      BX r14
0x80e88174      0xe1a02001      MOV r2, r1
0x80e88178      0xe1a01000      MOV r1, r0
0x80e8817c      0xe59f0000      LDR r0, [r15]

> step

target state: halted
target halted in ARM state due to breakpoint, current mode: Supervisor
spsr_svc: 0x400001d3 pc: 0x80e8815c
MMU: disabled, D-Cache: disabled, I-Cache: enabled

> step

target state: halted
target halted in ARM state due to breakpoint, current mode: Supervisor
spsr_svc: 0x400001d3 pc: 0x80e88154
MMU: disabled, D-Cache: disabled, I-Cache: enabled

> bp 0x80e88160 4 hw

breakpoint set at 0x80e88160

> resume

... type anything in U-Boot until breakpoint is hit ...

target state: halted
target halted in ARM state due to breakpoint, current mode: Supervisor
spsr_svc: 0x000001d3 pc: 0x80e88160
MMU: disabled, D-Cache: disabled, I-Cache: enabled

> bp

0x80e88160, 0x4, 1

> rbp 0x80e88160

> resume

GDB ARM

To debug an ARM target with GNU debugger (GDB), you need a GDB understanding ARM processor. If your ARM cross compilation tool chain doesn't include a GDB, you can easily build it your self.

Build

  • Download latest GDB sources. OpenOCD docu recommends to use GDB 6.7 or newer. Here, we use GDB 6.8 which is the recent version while writing this.
  • Extract, configure and build GDB for ARM. Afterwards remove temporary stuff. Options are:
    • <path_where_ARM_gdb_shall_be_installed_to> : Directory where you want to install the resulting tool to. E.g. /home/user/arm-gdb/
    • <ARM_toolchain_prefix> : The prefix of your ARM GCC toolchain, e.g. arm-linux or arm-none-linux-gnueabi (CodeSourcery tool chain).
> tar xfj gdb-6.8.tar.bz2
> mkdir build-gdb
> cd build-gdb/
build-gdb > ../gdb-6.8/configure --prefix=<path_where_ARM_gdb_shall_be_installed_to> --target=<ARM_toolchain_prefix> i686-pc-linux-gnu
build-gdb > make -j4
build-gdb > make install
build-gdb > cd ..
> rm -rf gdb-6.8 build-gdb
> export PATH=$PATH:<path_where_ARM_gdb_shall_be_installed_to>/bin

Test:

bin> ./arm-none-linux-gnueabi-gdb
GNU gdb 6.8
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".
(gdb)

Example session

To use gdb, you have to connect to running OpenOCD using remote command. E.g.:

> arm-none-linux-gnueabi-gdb
GNU gdb 6.8
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".

(gdb) target remote localhost:3333
Remote debugging using localhost:3333
0x00000000 in ?? ()                  
(gdb) monitor omap3_dbginit          
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080               
SWJ-DP STICKY ERROR                                                                     
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080                                       
    TargetName         Type       Endian TapName            State                       
--  ------------------ ---------- ------ ------------------ ------------                
 0* omap3.cpu          cortex_a8  little omap3530.dap       unknown                     
0x54011314 00000003                            ....                                     
0x54011314 00000001                            ....        
                             
(gdb) monitor scan_chain                                                                
    TapName            | Enabled |   IdCode      Expected    IrLen IrCap  IrMask Instr     
---|--------------------|---------|------------|------------|------|------|------|--------- 
 0 | omap3530.dsp       |    n    | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff
 1 | omap3530.dap       |    Y    | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a      
 2 | omap3530.jrc       |    Y    | 0x0b7ae02f | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f

(gdb) info registers
r0             0x0      0
r1             0x60a    1546
r2             0x80000100       2147483904
r3             0x706    1798              
r4             0xc00081b8       3221258680
r5             0x0      0                 
r6             0x80026960       2147641696
r7             0xc00081b8       3221258680
r8             0x0      0                 
r9             0x411fc082       1092599938
r10            0x800268f8       2147641592
r11            0xf731c8f9       4147235065
r12            0x80796ae0       2155440864
sp             0x8051a900       0x8051a900
lr             0x80008018       2147516440
pc             0x8000815c       0x8000815c
fps            0x0      0                 
cpsr           0x0      0  
               
(gdb) p/x $pc                              
$2 = 0x8000815c                             

(gdb) x/i $pc                              
0x8000815c:     nop                     (mov r0,r0)

(gdb) x
0x80008160:     b       0x8000815c

LED blink example

Magnus Lundin has a simple standalone LED blink test program which can be used for tests.

echo *** Executing .gdbint to set up the environment for debugging gdb:\n

# This connects to OpenOcd at localhost:3333
target remote localhost:3333

# omap3_dbginit must be run in OpenOCD after every reset
monitor omap3_dbginit

# Stop core
monitor halt

echo *** Environment ready, now load and start executeable:\n

# Load the program executable called "LEDblink"
load LEDblink

# Load the symbols for the program.
symbol-file LEDblink

# Set a breakpoint at main().
b main

# Run to the breakpoint.
cont

Clone the code by git, goto cortex_a8/standalone/LEDblink directory, build the example using provided Makefile and then in that directory start gdb (so that above .gdbinit is executed):

> arm-none-linux-gnueabi-gdb
GNU gdb 6.8
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-pc-linux-gnu --target=arm-none-linux-gnueabi".
*** Executing .gdbint to set up the environment for debugging gdb:
0x00000000 in ?? ()
The target may not be able to correctly handle a memory-write-packet-size
of 1024 bytes. Change the packet size? (y or n) [answered Y; input not from terminal]
    TargetName         Type       Endian TapName            State
--  ------------------ ---------- ------ ------------------ ------------
 0* omap3.cpu          cortex_a8  little omap3530.dap       unknown
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
spsr_svc: 0x600001d3 pc: 0x80008160
MMU: disabled, D-Cache: disabled, I-Cache: enabled
*** Environment ready, now load and start executeable:
Loading section .text, size 0xe0 lma 0x82000000
Start address 0x82000000, load size 224
Transfer rate: 4 KB/sec, 224 bytes/write.
Current language:  auto; currently asm
Breakpoint 1 at 0x8200003c: file LEDblink.c, line 22.

Breakpoint 1, main () at LEDblink.c:22
22                      LEDbrightness++;
Current language:  auto; currently c

(gdb) cont

This should let Beagle's LEDs blink.

Development internals

The sections below give some datails if you are interested in developing OpenOCD for OMAP3 and Cortex A8 used on Beagle. If you like to help to improve OpenOCD support for Beagle, this might help you.

Introduction

Magnus Lundin wrote a very nice introduction on the basic Cortex A8 (OMAP3) debug architecture.

Cortex A8 support

As mentioned above, OpenOCD has initial experimental Cortex A8 support. Rick Altherr wrote (thanks!) a nice intro how to help with Cortex A8 support for OpenOCD:

The Cortex-M3 support is very similar to Cortex-A8 up to a certain layer. The ARM debug interface is designed as a set of layers that build on each other and can do automatic discovery. The cortex-swjdp support in OpenOCD is a good start, but it assumes which AHB and APB ports are available. The first item would be to verify the cortex-swjdp portion against the documents for the CoreSight debug interface.

To really get started, familiarize yourself with the following docs:

These should be listed in the right order for getting up to speed. Basically the Cortex-A8 debug registers are accessed externally via CoreSight. CoreSight is an implementation of the ARM Debug Interface v5.

The cortex-swjdp implementation in OpenOCD deals with CoreSight but makes some assumptions about which CoreSight components are available. For Cortex-A8, that will likely need to change a bit as the set of components will be different.

After cortex-swjdp is patched to handle the new components, a cortex-a8 target implementation can be started by using the cortex-swjdp layer to access the various debug registers and memory locations.

For discussion about this, see mail #1, mail #2 and mail #3.

Note: With revision ~1570 the cortex-swjdp module in OpenOCD has been renamed to arm_adi_v5 and updated to remove all dependencies on Cortex-M3 specific features and as far as possible only use the ARM Debug Interface v5 features. The Cortex-M3 specifics has been moved to cortex_m3 module. This is a step in preparing OpenOCD for full Cortex-A8 support.

Using recent OpenOCD versions, you can examine CoreSight APs:

> version                                                                                    
Open On-Chip Debugger 0.3.0-in-development (2009-08-30-19:54) svn:2643M

> omap3_dbginit
JTAG tap: omap3530.jrc tap/device found: 0x0b7ae02f (mfg: 0x017, part: 0xb7ae, ver: 0x0)
JTAG Tap/device matched
AHBAP Cached values: dp_select 0x10, ap_csw 0xa2000002, ap_tar 0x54011080
SWJ-DP STICKY ERROR
Read MEM_AP_CSW 0x80000042, MEM_AP_TAR 0x54011080
   TargetName         Type       Endian TapName            State
--  ------------------ ---------- ------ ------------------ ------------
0* omap3.cpu          cortex_a8  little omap3530.dap       unknown
0x54011314 00000003                            ....
0x54011314 00000001                            ....

> scan_chain
    TapName            | Enabled |   IdCode      Expected    IrLen IrCap  IrMask Instr
---|--------------------|---------|------------|------------|------|------|------|---------
 0 | omap3530.dsp       |    n    | 0x00000000 | 0x00000000 | 0x26 | 0x25 | 0x3f | 0xffffffff
 1 | omap3530.dap       |    Y    | 0x00000000 | 0x0b6d602f | 0x04 | 0x01 | 0x0f | 0x0a
 2 | omap3530.jrc       |    Y    | 0x00000000 | 0x0b7ae02f | 0x06 | 0x01 | 0x3f | 0x3f

> dap apsel 0
ap 0 selected, identification register 0x14770001

> dap info 0
ap identification register 0x14770001
        Type is mem-ap AHB           
ap debugbase 0xffffffff              
        No ROM table present         

> dap info 1
ap identification register 0x04770002
        Type is mem-ap APB           
ap debugbase 0x80000000              
        ROM table in legacy format
        CID3 0xb1, CID2 0x5, CID1 0x10, CID0, 0xd
        MEMTYPE system memory not present. Dedicated debug bus
        ROMTABLE[0x0] = 0xd4010003                            
                Component base address 0x54010000, pid4 0x4, start address 0x54010000
                Component cid1 0x90, class is CoreSight component                    
                CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
                PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21                          
        ROMTABLE[0x4] = 0xd4011003                                                   
                Component base address 0x54011000, pid4 0x4, start address 0x54011000
                Component cid1 0x90, class is CoreSight component                    
                CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
                PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8                           
        ROMTABLE[0x8] = 0xd4012003                                                   
                Component base address 0x54012000, pid4 0x0, start address 0x54012000
                Component cid1 0x90, class is CoreSight component                    
                CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
                PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13                            
        ROMTABLE[0xc] = 0xd4013002                                                   
                Component not present                                                
        ROMTABLE[0x10] = 0xd4019003                                                  
                Component base address 0x54019000, pid4 0x4, start address 0x54019000
                Component cid1 0x90, class is CoreSight component                    
                CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
                PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12                           
        ROMTABLE[0x14] = 0xd401b003                                                  
                Component base address 0x5401b000, pid4 0x4, start address 0x5401b000
                Component cid1 0x90, class is CoreSight component                    
                CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
                PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7                             
        ROMTABLE[0x18] = 0xd401d003                                                  
                Component base address 0x5401d000, pid4 0x0, start address 0x5401d000
                Component cid1 0xf0, class is Non standard layout
                CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd
                PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43
        ROMTABLE[0x1c] = 0xd4500003
                Component base address 0x54500000, pid4 0x0, start address 0x54500000
                Component cid1 0x90, class is CoreSight component
                CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd
                PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20
        ROMTABLE[0x20] = 0x0
                End of ROM table

> dap apsel 1
ap 1 selected, identification register 0x04770002

> dap apsel 2
ap 2 selected, identification register 0x14760010

> dap info 2
ap identification register 0x14760010
        Type is jtag-ap
ap debugbase 0x00000000
        No ROM table present

> dap apsel 3
ap 3 selected, identification register 0x00000000

> dap info 3
ap identification register 0x00000000
No AP found at this apsel 0x3
        No ROM table present

>

ROMTable

To interpret content of above ROMTable, have a look to

With this, we get (first three entries are in the MPU SS Module, address range 0x54010000 - 0x54018000, part number is given by PID1[3-0] and PID0[7-0]):

ROMTABLE[0x0] = 0xd4010003                            
 Component base address 0x54010000, pid4 0x4, start address 0x54010000
 Component cid1 0x90, class is CoreSight component                    
 CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
 PID3 0x10, PID2 0x2b, PID1 0xb9, PID0, 0x21
ROMTABLE[0x4] = 0xd4011003                                                   
 Component base address 0x54011000, pid4 0x4, start address 0x54011000
 Component cid1 0x90, class is CoreSight component                    
 CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
 PID3 0x10, PID2 0x2b, PID1 0xbc, PID0, 0x8                           
ROMTABLE[0x8] = 0xd4012003                                                   
 Component base address 0x54012000, pid4 0x0, start address 0x54012000
 Component cid1 0x90, class is CoreSight component                    
 CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
 PID3 0x0, PID2 0x9, PID1 0x71, PID0, 0x13                            
  • Part number 0x113: This is ????
ROMTABLE[0x10] = 0xd4019003                                                  
 Component base address 0x54019000, pid4 0x4, start address 0x54019000
 Component cid1 0x90, class is CoreSight component                    
 CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
 PID3 0x0, PID2 0x1b, PID1 0xb9, PID0, 0x12                           
  • Part number 0x912: TPIU Module.
ROMTABLE[0x14] = 0xd401b003                                                  
 Component base address 0x5401b000, pid4 0x4, start address 0x5401b000
 Component cid1 0x90, class is CoreSight component                    
 CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd                            
 PID3 0x0, PID2 0xb, PID1 0xb9, PID0, 0x7                             
  • Part number 0x907: ETB Module.
ROMTABLE[0x18] = 0xd401d003                                                  
 Component base address 0x5401d000, pid4 0x0, start address 0x5401d000
 Component cid1 0xf0, class is Non standard layout
 CID3 0xb1, CID2 0x5, CID1 0xf0, CID0, 0xd
 PID3 0x0, PID2 0x9, PID1 0x73, PID0, 0x43
  • Part number 0x343: DAP CTL Module.
ROMTABLE[0x1c] = 0xd4500003
 Component base address 0x54500000, pid4 0x0, start address 0x54500000
 Component cid1 0x90, class is CoreSight component
 CID3 0xb1, CID2 0x5, CID1 0x90, CID0, 0xd
 PID3 0x0, PID2 0x19, PID1 0x71, PID0, 0x20
  • Part number 0x120: SDTI Module.

Debug Register Interface

With above info about debug register interface and table 12-3 in the Cortex-A8 TRM we are able to access this interface using OpenOCDs mdw command:

> omap3.cpu mdw 0x54011000
0x54011000 15141012

This is the debug ID register. See table 12-11 of Cortex-A8 TRM:

Bits Field Value & Function
[31-28] WRP 0x1 -> 2 WRPs are implemented
[27-24] BRP 0x5 -> 6 BRPs are implemented
[23-20] Context 0x1 -> 2 BRPs have context ID capability
[19-16] Debug architecture version 0x4 -> ARMv7 debug
[12] security 0x1 -> Security extensions implemented
[7-4] variant 0x1
[3-0] revision 0x2
> omap3.cpu mdw 0x54011FF0
0x54011ff0 0000000d
> omap3.cpu mdw 0x54011FF4
0x54011ff4 00000090
> omap3.cpu mdw 0x54011FF8
0x54011ff8 00000005
> omap3.cpu mdw 0x54011FFC
0x54011ffc 000000b1

These are the component identification registers. See table 12-51 of Cortex-A8 TRM.