BeagleBoardJTAG

From eLinux.org
Revision as of 02:57, 28 November 2012 by Yclinda666 (talk | contribs) (XDS100, XDS510, USB560 and CCSV4)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

The page is about JTAG on OMAP3530 used at BeagleBoard.

Beagle JTAG connection

The BeagleBoard comes with a 14 pin TI JTAG connector. For JTAG pin out see section 8.16 of BeagleBoard HW Reference Manual (rev. B5). This is the same header interface as used in other TI products and is NOT the standard 14 pin ARM layout. Depending on your JTAG tool, you'd need a 20-pin to 14-pin TI adapter.

Attention: JTAG on BeagleBoard uses 1.8V!

The 14-pin TI JTAG connector that is used on BeagleBoard is supported by a large number of JTAG emulation products and has been tested using Lauterbach, Green Hills, Spectrum Digital XDS510USB+ and TI XDS560 emulation pods. Note that it will not work with the Spectrum Digital XDS510USB (non-plus) as it does not support a target with 1.8V JTAG.

The following picture is from a TI OMAP JTAG presentation:

Ti arm jtag.jpg

Beagle uses the 14-pin TI header.

Note: TI uses some different pin names. Translation:

  • TVD => VREF at Beagle
  • TCLKR == RTCK
  • TCLKO == TCK
  • #### == Key (empty))
  • TDIS => GND at Beagle

See ICEPICK configuration page for more details about how OMAP3 JTAG hardware needs to be configured.

Beagle adapter

The Flyswatter we plan to use has a 14 pin ARM layout, so we need to create a converter. From JTAG pin assignments document:

     ARM-14-JTAG                               TI-14-JTAG

VREF        1 - - 2  GND           JTAG_TMS    1 -  - 2  JTAG_nTRST
JTAG_nTRST  3 - - 4  GND           JTAG_TDI    3 -  - 4  GND
JTAG_TDI    5 - - 6  GND           VREF        5 -  x 6  KEY (empty)
JTAG_TMS    7 - - 8  GND           JTAG_TDO    7 -  - 8  GND
JTAG_TCK    9 - - 10 GND           JTAG_RTCK   9 -  - 10 GND
JTAG_TDO   11 - - 12 JTAG_SRST_N   JTAG_TCK   11 -  - 12 GND
VREF       13 - - 14 GND           JTAG_EMU0  13 -  - 14 JTAG_EMU1
   FlySwatter                TOP               Beagle

See 14 pin ARM to TI adapter for a verified JTAG adapter from TinCanTools.

Open source JTAG software

It would be very interesting to get the JTAG working with open source tools. The main open source JTAG software is OpenOCD. See Beagle board OpenOCD page about status and usage of OpenOCD for Beagle.

JTAG hardware

For BeagleBoard JTAG debugging, there are some HW interfaces available. Each is covered below.

TinCanTools Flyswatter2

TinCanTools has a new JTAG debugger at Flyswatter2 that has support for OpenOCD and ARM Cortex A8 processors: OMAP3530 BeagleBoard and DM3730 BeagleBoard-xM. The Flyswatter2 is 5 to 10 times faster than the original Flyswatter.

They also have a ARM20TI14 JTAG Adapter. This JTAG adapter board works with the BeagleBoard and BeagleBoard-xM.

The Flyswatter2 can be used with OpenOCD (Beagle (OMAP3xx) support is complete).

TinCanTools Flyswatter

TinCanTools has a working JTAG debugger at Flyswatter that has support for OpenOCD and the OMAP3530 (ARM Cortex A8). They also have a BeagleBoard Adapter Kit.

Costs:

In case you like to order Flyswatter and Adapter Kit international, here an example for Europe (Germany):

  • Flyswatter: US-$ 49.95
  • BeagleBoard Adapter Kit: US-$ 18.00
  • International shipping: US-$ 27.00 (select USPS, it's the cheapest!)
  • Video about using Flyswatter with BeagleBoard

Sum: US-$ 94.95 => EUR 65.28 + EUR 8.76 VAT (Germany) = EUR 74.04

Flyswatter can be used with OpenOCD (Beagle (OMAP3xx) support is complete).

Attention: If you use BeagleBoard Adapter Kit, make sure you plug the JTAG adapter the correct way. There are several possible ways, though. See connection picture how to do it the right way (in contrast to the picture EMU0 & EMU1 jumpers at JTAG adapter should be both at 1-2 position (touching J2) because EMU0 and EMU1 must be set in order for the ICEpick JTAG TAP router within the DM37x to be the only device exposed after power on, which is what OpenOCD expects to see).

BDI 2000

Example

Chuck Fleming reports:

The BDI2000 appears to work with the omap35xx.cfg and regOMAP3500.def files that come with the BDI hardware. I had to modify the 10-pin cable so that the BeagleBoard JTAG header matched the BDI target A connector:

beagle>reset
- TARGET: processing reset request
- TARGET: BDI executes scan chain init string
- TARGET: Bypass check 0x00000001 => 0x00000002
- TARGET: JTAG exists check passed
- Core#0: ID code is 0x0B6D602F
- Core#0: DP-CSW  is 0xF0000000
- Core#0: DBG-AP  at 0xD4011000
- Core#0: DIDR    is 0x15141012
- TARGET: BDI removes RESET
- TARGET: BDI waits for RESET inactive
- TARGET: Reset sequence passed
- TARGET: resetting target passed
- TARGET: processing target startup ....
- TARGET: processing target startup passed
beagle>halt
     Core number       : 0
     Core state        : debug mode (ARM)
     Debug entry cause : Debug Request
     Current PC        : 0x40200000
     Current CPSR      : 0x000001d3 (Supervisor)
beagle>rdall
          User     FIQ     Superv   Abort     IRQ      Undef
GPR00: 480029fc 480029fc 480029fc 480029fc 480029fc 480029fc
GPR01: 00000000 00000000 00000000 00000000 00000000 00000000
GPR02: 00000001 00000001 00000001 00000001 00000001 00000001
GPR03: 00000060 00000060 00000060 00000060 00000060 00000060
GPR04: 00000000 00000000 00000000 00000000 00000000 00000000
GPR05: 80f2f2f4 80f2f2f4 80f2f2f4 80f2f2f4 80f2f2f4 80f2f2f4
GPR06: 80f2f2f4 80f2f2f4 80f2f2f4 80f2f2f4 80f2f2f4 80f2f2f4
GPR07: 80e9ee88 80e9ee88 80e9ee88 80e9ee88 80e9ee88 80e9ee88
GPR08: 80e3ffdc 34484608 80e3ffdc 80e3ffdc 80e3ffdc 80e3ffdc
GPR09: 80e3fec8 26a1c132 80e3fec8 80e3fec8 80e3fec8 80e3fec8
GPR10: 00000018 08040f16 00000018 00000018 00000018 00000018
GPR11: 80e3fecc 3c278260 80e3fecc 80e3fecc 80e3fecc 80e3fecc
GPR12: 0000006e 24200625 0000006e 0000006e 0000006e 0000006e
GPR13: 00000000 00000000 80e3feb0 00000000 00000000 d1868045
GPR14: 00000000 00000000 80e84f44 00000000 00000000 d55a4cc8
PC   : 40200000
CPSR : 000001d3
SPSR :          00000000 00000000 00000000 00000000 00000000
beagle>md 0x40200000
40200000 : e320f000 e320f000 e320f000 e320f000  .. ... ... ... .
40200010 : e320f000 e320f000 e320f000 eafffffc  .. ... ... .....
40200020 : b6273502 e7aa052b 047694c8 91ca77d8  .5'.+.....v..w..
40200030 : 12b9579e ef2eef1b 00543892 494f9bc1  .W.......8T...OI
40200040 : 3f63013d 82eee656 b7adfe8d 993f1368  =.c?V.......h.?.
40200050 : 51f1cf9b 0464a23e bea76e3c 3d275f5c  ...Q>.d.<n..\_'=
40200060 : 76554290 6776c892 a6cd088f 6dd4529a  .BUv..vg.....R.m
40200070 : 067261b8 e5f80e9e cb4ea075 25a9dd95  .ar.....u.N....%
40200080 : 779db8c6 0496597b 7d5f8d5a 24f44cd6  ...w{Y..Z._}.L.$
40200090 : 99ab46f9 9ddc06d9 fd34567a 2035bab8  .F......zV4...5
402000a0 : a16b6760 fe863cf7 29046202 39fb0d49  `gk..<...b.)I..9
402000b0 : dc9fd18c e50f536c 09ae66dd cad9ff91  ....lS...f......
402000c0 : c46bdbdb be791808 89ff83fa 2d3bc71e  ..k...y.......;-
402000d0 : 43f5a3b6 0aed1747 ba3c4752 6af0573a  ...CG...RG<.:W.j
402000e0 : 3570da77 9a1dc961 324b876c 5d592060  w.p5a...l.K2` Y]
402000f0 : b870f487 1277c035 4609dcf4 53b534c4  ..p.5.w....F.4.S
beagle>ti
     Core number       : 0
     Core state        : debug mode (ARM)
     Debug entry cause : Single Step
     Current PC        : 0x40200004
     Current CPSR      : 0x000001d3 (Supervisor)
beagle>ti
     Core number       : 0
     Core state        : debug mode (ARM)
     Debug entry cause : Single Step
     Current PC        : 0x40200008
     Current CPSR      : 0x000001d3 (Supervisor)
beagle>

BDI config

The BDI config files might help getting OpenOCD to work with BeagleBoard.

This configuration assumes the "default" EMU 0 and 1 configuration (both not connected/high state). In this EM setup at first only one TAP is exported. A set of commands must be run on the first tap (embedded ICE) to enable access to the core:

SCANINIT    t1:w1000:t0:w1000:  ;toggle TRST,
SCANINIT    ch10:w1000:         ;clock TCK with TMS high and wait
SCANINIT    i6=07:d8=89:i6=02:  ;connect and select router
SCANINIT    d32=81000080:       ;IP control: KeepPowered
SCANINIT    d32=a3002048:       ;TAP3: DebugConnect, ForcePower, ForceActive
SCANINIT    d32=81000081:       ;IP control: KeepPowered, SysReset
SCANINIT    d32=a3002148:       ;enable TAP3
SCANINIT    cl10:i10=ffff       ;clock 10 times in RTI, scan bypass

Lauterbach

Lauterbach Debugger supports OMAP3503/15/25/30.

XDS100, XDS510, USB560 and CCSV4

Texas Instruments (TI) offers a set of JTAG emulators for debugging Beagle Board, and related, targets. These include the low-cost XDS100v2, and the higher-priced XDS510 et al. In addition, there is en Eclipse-based IDE called Code Composer Studio (ccs). As of early 2011, the latest version is ccsv5, and it can be run on either a Linux host or a Windows host. Debugging is possible in both run-mode and stop-mode.

XDS100v2 USB JTAG Emulator is available from Embest which is the second release of the XDS100 JTAG emulator technology supporting debug of a variety of TI devices.

XDS510, BlackHawk USB560 and CCSV4 (code composer studio) can be used to debug OMAP3503/15/25/30.

Some of these tools can be found on the TI tools directory.

For CCS setup you see TI OMAP JTAG presentation, too (start page: 16).

BeagleBoard Linux Kernel Aware Debugging using CCSV4

Linux Aware debugging using CCSV4 is described in CCSV4 Linux Aware Debugging. CCSV4 is available for download from CCSV4.

CCSV4 Current Status

  • CCSV4 is a Windows based application, which means that Linux Kernel Code compiled an a Linux machine must be shared using NFS for SAMBA.
  • Although CCSV4 is based on Eclipse, it will not work on Linux as there are currently no Linux Drivers for the JTAG Emulators. TI are developing Linux Drivers, but have not disclosed a release date
  • CCSV4 is based on Eclipse V3.1.0, which means that many of the features added through Eclipse based V3.4.2 are missing
  • TI are updating CCSV4 to use Eclipse V3.4.2, but have not disclosed a release date
  • When TI release CCSV4 using Eclipse V3.4.2, I expect TI to release a CCSV4 plugin for Code Sourcery
  • TI have produced a very good debugger, but there are still several bugs that TI are actively working to resolve and should be released in an update shortly. Most of these bugs are not show stoppers, but merely operational annoyances.
  • Blackhawk have released a $99 USB100, which is compatible with CCSV4. Please refer to XDS100 about compatibility. Update: While CCSV4 does support XDB100, XDS100 does not yet support CortexA8 or C64X+. So, 4.02 (due in 11/09) will have XDS100 beagleboard support.

PEEDI

PEEDI JTAG/BDM Emulator and Flash Programmer of Ronetix supports OMAP3. A configuration file for the Beagleboard can be found here: omap3530.cfg

PEEDI has a built-in support for GNU gbd based debuggers and a built-in Flash Programmer. The Flash Programmer is capable to program:

  • NOR Flash devices (over 900)
  • NAND and OneNAND Flash devices (small page, larger page, 8/16 bit), various methods of ECC calculation, bad block management.
  • DataFlash devices
  • SPI DataFlash devices
  • images located on a TFTP/FTP/HTTP server or a MMC/SD card (which allows standalone mode).

The PEEDI package includes also an PEEDI to TI14 adapter and an TI20 to TI14 adapter.

Linux Kernel Aware Debugging using PEEDI Emulator

  • For Linux Aware debugging, PEEDI is a great solution. Here is what you will need:
  • PEEDI JTAG emulator
  • Firmware version 9.8.216 or later
  • Arm Insight Debugger available on the Ronetix CDROM

Note: Enter all commands executed from the Linux Kernel build folder.

Stopping the Debugger at start_kernel

  • In OMAP3530.CFG, change the hardware breakpoint address in the [INIT_LINUX] section to the address of start_kernel
  • To obtain the address of start_kernel, use "nm vmlinux |grep -w start_kernel"
  • If your u-boot counts down from 10, you will need to extend the debugger timeout
  • Two lines down, change the line to "wait 25000 stop"
  • Power up the BeagleBoard and PEEDI
  • Let u-boot countdown and load the Linux Kernel
  • PEEDI will stop at "start_kernel"

Launching the Insight Debugger

  • Install the ARM Insight Debbugger from the Ronetix CDROM, which is normally installed in the /opt folder
  • From the Linux Kernel build folder type "/opt/arm-linux-4.3.3/bin/arm-linux-insight vmlinux &"
  • In the Console Window, type "target remote <xxx.xxx.xxx.xxx>:2000, where <xxx.xxx.xxx.xxx> is the BeagleBoard IP address
  • Next, type "ni". The Source Window will load /init/main.c and highlight a line in start_kernel
  • Step through the code, or enter breakpoints and run the program.

Thread List

  • If you are doing multi-threaded debugging, this feature is invaluable
  • The PEEDI config file (OMAP3530.CFG) must be setup to read this info from your kernel
  • The information needed by Insight GDB is in the [OS_ARM_LINUX_v26] section
  • This information is obtained from the Insight GDB Console Window
  • print &init_task ; BASE
  • print &((struct task_struct*)0)->tasks.next ; NEXT
  • print &((struct task_struct*)0)->pid ; PID
  • print &((struct task_struct*)0)->comm ; NAME
  • print &((struct task_struct*)0)->stack ; second CONTEXT arg
  • print &((struct thread_info*)0)->cpu_context ; third CONTEXT arg

For Linux Kernel v2.6.29, this section looks something like this:

  • BASE = 4, 0xC066B110
  • NEXT = 4, -0x1B8
  • PID = 4, 0x1E4
  • NAME = 16, 0x2DB
  • CONTEXT = 10*4, 0x4, 0x1C

Note: the BASE address will most definitely be different to the one provided here, but the other values should be similar.

Ronetix technical support is excellent and they added features like the Thread List in just over a week. When I reported what seemed like a bug, they fixed most of them in just a few days. Overall, I am very impressed with the PEEDI emulator and it works great with the BeagleBoard. PEEDI is certainly the most responsive emulator I have worked with and what I like most is it is one of the few that works natively within Linux.

ARM Development Studio 5 (DS-5™)

The reference software development suite from ARM, DS-5, supports JTAG-based debug and ETM trace with Linux kernel awareness on OMAP34XX/OMAP35XX/OMAP36XX/OMAP44XX and other ARM-based devices. Its target connection is called DSTREAM, and is spec'd to provide reliable and fast run-control debug and 4GB of non-intrusive instruction trace.

For ease of use for Beagle board users, it even provides BB and BB xM Linux distribution examples.

Linux kernel debugging

If you like to debug Linux kernel (with one of the above JTAG tools?) using GDB have a look to Debugging The Linux Kernel Using Gdb article.